The Linux kernel IPMI driver originally fetched events and received messages until the Baseboard Management Controller (BMC) signaled that it was finished. Because some BMCs never send a completion signal or an attention bit can become stuck, the driver would loop indefinitely, consuming CPU cycles and potentially exhausting kernel resources. The fix introduces a limit of ten fetches per request and allows message handling in between flag fetches, preventing the driver from becoming stuck.

Systems running a Linux kernel that includes the IPMI driver before the inclusion of the limit are potentially affected. The known CNA vendor is Linux:Linux, and the vulnerability covers all kernel releases that have not yet integrated the commit adding the fetch limits. No specific version range is provided in the advisory.

The EPSS score is reported as less than 1%, and the vulnerability is not listed in CISA's KEV catalog, indicating a low likelihood of known exploitation. It is inferred from the description that an attacker who can send commands to the BMC—either remotely or locally—could trigger the condition and cause a denial of service by exhausting kernel resources. The CVSS score of 7.5 indicates high severity, underscoring the potential for a local or remote resource exhaustion attack.