ipmi: Fix user refcount underflow in event delivery

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-72042
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-15 06:21:13 UTC
Updated2026-08-17 06:18:02 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg(). That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference. Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001980000 probability, percentile 0.099120000 (date 2026-08-16)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected b52da4054ee0bf9ecb44996f2c83236ff50b3812 ddbb6e3dc9bb4743de686aa1598c31e745cee76b git Not specified
CNA Linux Linux affected b52da4054ee0bf9ecb44996f2c83236ff50b3812 7be349d4fcc5e065295b83418a22d27a68afbdb6 git Not specified
CNA Linux Linux affected b52da4054ee0bf9ecb44996f2c83236ff50b3812 6aa9e61c46465d231e9beddf56af7effd71be682 git Not specified
CNA Linux Linux affected f63723ca7d7623f9dae1990973cd158671f03c56 git Not specified
CNA Linux Linux affected 348121b29594d42d1635648fd3ed31dfa25351d5 git Not specified
CNA Linux Linux affected 53d6e403affbf6df2c859a0ea00ccfc1e72090ca git Not specified
CNA Linux Linux affected 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5 git Not specified
CNA Linux Linux affected 6.1.157 6.2 semver Not specified
CNA Linux Linux affected 6.6.113 6.7 semver Not specified
CNA Linux Linux affected 6.12.54 6.13 semver Not specified
CNA Linux Linux affected 6.17.4 6.18 semver Not specified
CNA Linux Linux affected 6.18 Not specified
CNA Linux Linux unaffected 6.18 semver Not specified
CNA Linux Linux unaffected 6.18.40 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.5 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report