Executive brief
The Linux kernel's IPMI SI driver can crash with a NULL pointer dereference when device registration fails. If the BMC (baseboard management controller) doesn't respond properly to device identification requests, the driver's cleanup code doesn't fully quiesce background work, allowing a retry operation to access already-freed memory. This can cause a kernel crash or system instability on servers using IPMI for hardware monitoring.
Technical details
The vulnerability is a use-after-free / NULL pointer dereference in the IPMI SI (System Interface) driver. During ipmi_add_smi(), if __bmc_get_device_id() fails to retrieve device information from the BMC, the error path invokes the lower driver's shutdown callback (shutdown_smi()) which frees smi_info->si_sm and sets it to NULL. However, intf->in_shutdown is not set on this rollback path, allowing the asynchronous redo_bmc_reg() work item to retry BMC probing and eventually call start_next_msg(), which dereferences the already-freed si_sm pointer. No authentication or network access is required; the condition is triggered by a BMC that returns a nonzero completion code to the Get Device ID command. The fix sets intf->in_shutdown before invoking the shutdown callback to prevent later retries from using the cleaned-up interface.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed