Executive brief
A vulnerability in the Linux kernel's IPMI driver could allow a faulty or malicious Baseboard Management Controller (BMC) to cause a denial-of-service condition. The driver would continuously attempt to fetch data from the BMC without limit, potentially causing the system driver to become stuck or unresponsive. This affects servers using IPMI for hardware management and monitoring.
Technical details
A vulnerability in the Linux kernel IPMI driver (ipmi_si and ipmi_ssif) exists because the driver fetches events and messages in a loop until the BMC indicates it is finished. If a BMC is buggy or malicious and never clears its 'data available' flags, the driver can enter an infinite loop or become wedged. The fix introduces a limit of 10 consecutive fetches and ensures that system messages can be processed even if the 'attention' bit remains stuck. This issue is primarily a robustness fix against malformed hardware responses that could lead to local denial of service.
Affected products
- Linux Linux kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-20: other: Patch authored by Corey Minyard
- 2026-05-28: advisory: CVE published by kernel.org
References
- https://git.kernel.org/stable/c/3d37d2165df9504ea99d9e6181552dc4d2d1ab37
- https://git.kernel.org/stable/c/67c44e0deba936d5edaebea356b4589eb43acb5c
- https://git.kernel.org/stable/c/c024167fb00489baee08c72182ca2e7dc5fb9f20
- https://git.kernel.org/stable/c/c4cca236968683eb0d59abfb12d5c7e4d8514227
- https://git.kernel.org/stable/c/e20212b431bef217d3886b86bbc90cc3ed00de68