Executive brief
The Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem has a resource cleanup defect that occurs when an interface fails to start. Scheduled work tasks are not properly canceled before the interface is freed, potentially causing memory corruption or use-after-free conditions. This can lead to kernel crashes, data corruption, or local privilege escalation on systems with IPMI hardware or drivers enabled.
Technical details
The vulnerability is a missing cancel_work_sync() call in the IPMI message handler's ipmi_add_smi() function error path. When IPMI interface initialization fails after scheduling work, the queued work is never canceled before the interface structure is freed via kref_put(). This creates a use-after-free condition where the work queue may attempt to dereference freed memory. The fix adds an explicit cancel_work_sync(&intf->smi_work) call before cleanup. The vulnerability affects kernel versions 7.0 and later in the stable tree. Exploitation requires local system access and IPMI subsystem presence; no network vector exists.
Affected products
- Linux Linux kernel 7.0 and later
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched