Junglewise Threat Intelligence

CVE-2026-43221: Linux Kernel uninitialized resource in IPMI IPMB handler

CVE-2026-43221 · Severity: medium · CVSS 5.5 · Published 2026-05-06

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) component could allow a local user to cause a system malfunction. The issue occurs when the system handles certain hardware communication requests, potentially leading to a denial-of-service condition. This affects servers using IPMB for hardware management and monitoring.

Technical details

A 'Use of Uninitialized Resource' (CWE-908) vulnerability exists in the Linux kernel's IPMI over IPMB (Intelligent Platform Management Bridge) driver (drivers/char/ipmi/ipmi_ipmb.c). The ipmi_ipmb_slave_cb function failed to initialize the read byte value during I2C_SLAVE_READ_REQUESTED and I2C_SLAVE_READ_PROCESSED events. Although IPMB typically does not use I2C reads, a triggered I2C read would return an uninitialized value from the bus driver. A local attacker with low privileges could potentially exploit this to cause a kernel-level denial-of-service (A:H). The issue has been patched across multiple stable kernel branches by explicitly initializing the value to 0xff.

Affected products

  • Linux Linux Kernel 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6

Timeline

  • 2026-05-06: disclosed
  • 2026-05-06: advisory
  • 2026-03-04: patched: Patches integrated into various stable branches.

References

Related threats