Executive brief
The Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem handles device management and monitoring for server hardware. When registering a new IPMI interface fails during sysfs file creation, the cleanup code was incomplete, leaving orphaned device attributes referencing freed memory. This can lead to kernel memory corruption, crashes, or potential privilege escalation on systems using IPMI.
Technical details
This is a resource cleanup vulnerability in the IPMI message handler's ipmi_add_smi() function. During interface registration, the code creates nr_users and nr_msgs sysfs attributes before attempting to create a maintenance_mode attribute. If the maintenance_mode creation fails, the error handler removes only nr_users but leaves nr_msgs registered—a dangling pointer to freed memory embedded in the interface object. The fix adds device_remove_file() for nr_msgs in the error path. The vulnerability affects kernels 6.18 and later where the maintenance_mode sysfs file was introduced. A system with IPMI hardware or driver that experiences registration failures can trigger the bug; no special privileges or network access required.
Affected products
- Linux Linux kernel 6.18 and later
Timeline
- 2026-09-11: disclosed
- 2026-08-12: patched