Executive brief
The Linux kernel's IPMI intelligent platform management bus (IPMB) driver contained an input validation flaw in its write message handler. The vulnerability allowed reading uninitialized stack memory or causing an integer underflow via specially crafted write operations with zero or incorrect message lengths, potentially exposing sensitive kernel data or triggering a denial of service.
Technical details
The ipmb_write() function in drivers/char/ipmi/ipmb_dev_int.c failed to validate the message length byte before reading message fields from user-supplied buffers. This out-of-order validation allowed attackers to trigger stack memory disclosure (reading uninitialized bytes) or integer underflow in SMBus header length calculation via zero-length writes or writes with lengths smaller than the minimum IPMB request size. The fix requires non-empty input buffers, enforces the minimum IPMB request length, and validates that the declared message length plus payload fits within the provided buffer before parsing. The vulnerability affects all Linux kernel versions containing the original IPMB driver support code (introduced via commit 51bd6f291583).
Affected products
- Linux Linux kernel 2.6.11 and later (all versions prior to the fix)
Timeline
- 2026-09-11: disclosed: CVE-2026-81007 published
- 2026-07-02: patched: Fix committed upstream by Corey Minyard
- 2026-09-07: patched: Fix backported to stable kernel branches