CVE-2026-72042 - Vulnerability Details

- ipmi: Fix user refcount underflow in event delivery

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix user refcount underflow in event delivery

ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the
receive message, and ipmi_free_recv_msg() drops it again. If event delivery
fails after allocating receive messages for earlier users,
handle_read_event_rsp() rolls those messages back with
ipmi_free_recv_msg().

That rollback path still drops user->refcount explicitly after freeing each
message. The extra put can free a user that remains linked on intf->users,
so later event delivery may dereference a freed user or trip refcount_t's
addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire
another reference.

Remove the stale explicit put and the now-dead user assignment. Keep the
list_del() and ipmi_free_recv_msg() calls; they are the required rollback
operations.

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, a bug in the IPMI subsystem allows the user reference counter to be decremented below zero during event delivery. The underflow can free a user object that is still referenced in the interface list, leading to a use‑after‑free dereference or a refcount_t addition‑on‑zero warning. This memory corruption can cause a kernel panic and loss of service for the affected host.

Affected Systems

The flaw exists in the Linux kernel IPMI driver. No specific version range is provided in the advisory, so any kernel built with the current IPMI code may be affected.

Risk and Exploitability

Based on the description, exploitation would likely require interacting with the IPMI event delivery process, which could be accessed locally or remotely if the IPMI interface is exposed. The risk therefore includes denial of service via kernel panic if attackers can trigger the underflow repeatedly. However, the EPSS score is below 1%, indicating a low probability of successful exploitation in the near term. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly documented exploitation is currently known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b52da4054ee0bf9ecb44996f2c83236ff50b3812`	affected	< ddbb6e3dc9bb4743de686aa1598c31e745cee76b
`b52da4054ee0bf9ecb44996f2c83236ff50b3812`	affected	< 7be349d4fcc5e065295b83418a22d27a68afbdb6
`b52da4054ee0bf9ecb44996f2c83236ff50b3812`	affected	< 6aa9e61c46465d231e9beddf56af7effd71be682
`f63723ca7d7623f9dae1990973cd158671f03c56`	affected	—
`348121b29594d42d1635648fd3ed31dfa25351d5`	affected	—
`53d6e403affbf6df2c859a0ea00ccfc1e72090ca`	affected	—
`0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5`	affected	—
`6.1.157`	affected	< 6.2
`6.6.113`	affected	< 6.7
`6.12.54`	affected	< 6.13
`6.17.4`	affected	< 6.18

Linux

affected

Version	Status	Constraints
`6.18`	affected	—
`0`	unaffected	< 6.18
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b52da4054ee0bf9ecb44996f2c83236ff50b3812,ddbb6e3dc9bb4743de686aa1598c31e745cee76b)`	affected	code_commit	—
`[b52da4054ee0bf9ecb44996f2c83236ff50b3812,7be349d4fcc5e065295b83418a22d27a68afbdb6)`	affected	code_commit	—
`[b52da4054ee0bf9ecb44996f2c83236ff50b3812,6aa9e61c46465d231e9beddf56af7effd71be682)`	affected	code_commit	—
`[f63723ca7d7623f9dae1990973cd158671f03c56,*]`	affected	code_commit	—
`[348121b29594d42d1635648fd3ed31dfa25351d5,*]`	affected	code_commit	—
`[53d6e403affbf6df2c859a0ea00ccfc1e72090ca,*]`	affected	code_commit	—
`[0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5,*]`	affected	code_commit	—
`[6.1.157,6.2)`	affected	semver	—
`[6.6.113,6.7)`	affected	semver	—
`[6.12.54,6.13)`	affected	semver	—
`[6.17.4,6.18)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.18`	affected	generic	—
`[0,6.18)`	unaffected	generic	—
`[6.18.40,6.18.*]`	unaffected	generic	—
`[7.1.5,7.1.*]`	unaffected	generic	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the patched IPMI subsystem
Verify that the IPMI driver is not compiled into unused kernel modules to reduce attack surface
If the IPMI interface is not required, disable it or block incoming traffic to IPMI ports to prevent remote exploitation
Apply additional kernel hardening measures such as CONFIG_IPMI_DEVICE_PORT and restrict access to /dev/ipmi via ACLs

Generated by OpenCVE AI on August 17, 2026 at 21:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00162.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682
https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6
https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b
https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72042-3b9c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72042
https://www.cve.org/CVERecord?id=CVE-2026-72042

History

Mon, 17 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72042-3b9c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72042 https://www.cve.org/CVERecord?id=CVE-2026-72042
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 17 Aug 2026 08:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-795

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-795

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg(). That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference. Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.
Title		ipmi: Fix user refcount underflow in event delivery
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682 https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6 https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:01.454Z

Updated: 2026-08-17T05:39:41.572Z

Reserved: 2026-08-09T03:40:39.902Z

Link: CVE-2026-72042

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:13.370

Modified: 2026-08-17T06:18:02.133

Link: CVE-2026-72042

Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72042 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-17T21:00:14Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object