Executive brief
A vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) driver could lead to system instability when interacting with certain hardware management controllers. The issue occurs because the system does not properly validate the size of messages received from the hardware, potentially leading to improper data processing. This could affect the reliability of server management and monitoring operations.
Technical details
A vulnerability was identified in the Linux kernel IPMI subsystem, specifically within the 'ipmi_si_intf.c' component. The issue stems from insufficient validation of the response data size in 'handle_transaction_done' when fetching event messages. Certain Baseboard Management Controllers (BMCs) return empty messages instead of the expected 0x80 error code when no events are present, violating the IPMI specification. If the kernel attempts to process these undersized responses without immediate length checking, it may lead to undefined behavior or memory corruption during subsequent processing. The fix introduces a check to ensure the response size is exactly 19 bytes as required by the protocol before proceeding.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-20: other: Initial patch authored by Corey Minyard
- 2026-05-28: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/2418e4b21fb1355504d095da5d5f0a210564a43d
- https://git.kernel.org/stable/c/24269264c3d59a49eb09b10af2c75b14f2931482
- https://git.kernel.org/stable/c/36920f30e78e69df01f9691c470b6f3ba8aebf98
- https://git.kernel.org/stable/c/42432b579a594b66ac32e5e7b7c26e6bc578ec89
- https://git.kernel.org/stable/c/7f7ada72c07a83b46045ddfeee526bd9e2e3c8f0