A flaw in the IPMI SMI sender’s error handling causes a message already queued for delivery to be processed again. This repeats the list insertion and corrupts the kernel message list, leading to a use‑after‑free and a subsequent NULL pointer dereference when the entry is accessed. The result is kernel memory corruption that can trigger a panic or denial of service.

All Linux kernel versions that include the vulnerable IPMI implementation—i.e., any kernel released before the commit that clears the current message pointer and frees error messages—may be affected. The issue resides in the kernel itself, so any user‑space process or privileged component that interacts with the host’s IPMI interface can encounter the problem. Administrators should treat all older kernels as at risk until the patch is applied.

The estimated likelihood of exploitation is below one percent, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker would need to provoke the error path in the SMI sender, which typically requires local or privileged network access to an IPMI‑enabled host. Successful exploitation could cause a kernel crash and service interruption; while the damage could, in theory, lead to privilege escalation via kernel destabilization, the description does not confirm that code execution is feasible.