Junglewise Threat Intelligence

CVE-2026-81005: Linux kernel ipmi_si NULL pointer dereference after failed registration

CVE-2026-81005 · Severity: info · Published 2026-09-11

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's IPMI SI driver can crash with a NULL pointer dereference when device registration fails. If the BMC (baseboard management controller) doesn't respond properly to device identification requests, the driver's cleanup code doesn't fully quiesce background work, allowing a retry operation to access already-freed memory. This can cause a kernel crash or system instability on servers using IPMI for hardware monitoring.

Technical details

The vulnerability is a use-after-free / NULL pointer dereference in the IPMI SI (System Interface) driver. During ipmi_add_smi(), if __bmc_get_device_id() fails to retrieve device information from the BMC, the error path invokes the lower driver's shutdown callback (shutdown_smi()) which frees smi_info->si_sm and sets it to NULL. However, intf->in_shutdown is not set on this rollback path, allowing the asynchronous redo_bmc_reg() work item to retry BMC probing and eventually call start_next_msg(), which dereferences the already-freed si_sm pointer. No authentication or network access is required; the condition is triggered by a BMC that returns a nonzero completion code to the Get Device ID command. The fix sets intf->in_shutdown before invoking the shutdown callback to prevent later retries from using the cleaned-up interface.

Affected products

  • Linux Linux kernel <UNKNOWN>

Timeline

  • 2026-09-11: disclosed

Related threats