Executive brief
The Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem contains a reference counting leak in the i_ipmi_request() function. When callers supply pre-allocated message structures and an error occurs during processing, the function fails to properly clean up reference counts, leaving them permanently elevated. This can exhaust kernel resources and eventually prevent legitimate IPMI operations from succeeding.
Technical details
The vulnerability is a reference counting leak (CWE-416) in drivers/char/ipmi/ipmi_msghandler.c. When a caller provides a supplied_recv message, the function increments the user's nr_msgs reference count. If an error occurs later (e.g., SMI message allocation fails), the out_err cleanup path only frees the recv_msg if the function allocated it itself. For supplied_recv cases, cleanup is skipped, leaving nr_msgs elevated. The ipmi_request_supply_msgs() caller does not release the supplied_recv on error, permanently leaking the reference. The fix adds explicit reference count reversion in the error paths: decrementing nr_msgs and dropping the user's kref when a supplied recv_msg with valid user pointer is present. This is a local vulnerability requiring the caller to trigger error conditions.
Affected products
- Linux Linux kernel multiple versions (the vulnerability was present across many kernel versions from 2.6.x through 6.x and fixed in later releases)
Timeline
- 2026-08-15: disclosed: CVE-2026-72040 published
- 2026-06-03: patched: Upstream fix committed by Wentao Liang
- 2026-07-24: patched: Fix merged to stable kernel trees