The vulnerability arises from missing validation of an event message buffer returned by a BMC. Instead of rejecting an empty response, the kernel accepts it and proceeds to process the data, which can lead to a kernel crash or incorrect state handling. This failure to check response length can be triggered by a malicious or defective BMC, resulting in a denial of service on the host system. The impact is confined to the availability of the IPMI subsystem and potentially the overall system if the kernel panics.

This flaw affects the Linux kernel when compiled with the default IPMI subsystem. All kernels that have not applied upstream changes that enforce a length check on the event buffer are vulnerable. No specific version range is listed, so any kernel prior to the application of the commit series referenced in the source log should be considered at risk. The affected vendor/product is Linux:Linux; the product name is Linux kernel.

The likely attack vector is remote, inferred from the fact that IPMI interfaces are typically accessed over network management channels: an attacker can manipulate a BMC or supply crafted data to the IPMI interface over the network. While an exact CVSS score is not provided, the flaw allows for a crash that can be repeated; its EPSS score is < 1% and the flaw is not currently in the CISA KEV catalog. Nonetheless, because IPMI is often accessible from host management networks, the potential for exploitation is significant. No public exploit has been observed, but the logic flaw presents a clear path for a denial‑of‑service condition.