CVE-2026-81004

ipmi:msghandler: Cancel work cleanly on an error

Published Sep 11, 2026 CVSS 3.1 · 8.4 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmi:msghandler: Cancel work cleanly on an error

If an error occurs during startup of an IPMI interface, it may have
scheduled work to run. The work needs to be canceled before the
interface can be freed.

Analysis

Technical impact

TheMI message interface, if an error is encountered, the work scheduled to run is not properly cancelled. This oversight can lead to dangling references or usage of freed resources, potentially triggering a kernel panic or memory corruption, thus denying service. The flaw is identified as a use‑after‑free bug under CWE‑772.

Affected Systems

All Linux kernel builds that include the IPMI subsystem are affected, including the mainstream kernel. All kernel versions prior to the commit that fixes the faulty cancellation logic are considered at risk.

Risk and Exploitability

The CVSS base score of 8.4 indicates a high severity assessment. The EPSS score is < 1%, indicating a very low exploitation probability. It is inferred that the attack vector is local, requiring privileged access to load or modify kernel modules during system boot or the advisory. Given the kernel-level nature of the flaw, an attacker with sufficient privileges could crash the host but there is no evidence of remote code execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`edb6c2118293c1fba9cd11ca80ed043d2411a7e5`	affected	< 99692252b348c11377fd0cdd66b6b18f3b22758e
`62cd145453d577113f993efd025f258dd86aa183`	affected	< a496c51dd3257ed7e00873af2ad9bb22c3ddc4cf
`62cd145453d577113f993efd025f258dd86aa183`	affected	< ae84a2536577057e97f23f75a202e26d0e86cf01
`5199fc5dc9c519115457406009fcefd50721c995`	affected	—
`6.18.20`	affected	< 6.18.50
`6.19.10`	affected	< 6.20

Linux

affected

Version	Status	Constraints
`7.0`	affected	—
`0`	unaffected	< 7.0
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[edb6c2118293c1fba9cd11ca80ed043d2411a7e5,99692252b348c11377fd0cdd66b6b18f3b22758e)`	affected	code_commit	—
`[62cd145453d577113f993efd025f258dd86aa183,a496c51dd3257ed7e00873af2ad9bb22c3ddc4cf)`	affected	code_commit	—
`[62cd145453d577113f993efd025f258dd86aa183,ae84a2536577057e97f23f75a202e26d0e86cf01)`	affected	code_commit	—
`5199fc5dc9c519115457406009fcefd50721c995`	affected	code_commit	—
`[6.18.20,6.18.50)`	affected	semver	—
`[6.19.10,6.20)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`7.0`	affected	generic	—
`[0,7.0)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that includes the commit fixing this issue.
If an immediate kernel update is not possible, disable the IPMI module work scheduling path.
Restart the system after disabling or updating to ensure no dangling work remains and monitor kernel logs for IPMI errors.

Generated by OpenCVE AI on September 21, 2026 at 02:41 UTC.

Tracking

Advisories

Source	ID	Title
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.178% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/99692252b348c11377fd0cdd66b6b18f3b22758e
https://git.kernel.org/stable/c/a496c51dd3257ed7e00873af2ad9bb22c3ddc4cf
https://git.kernel.org/stable/c/ae84a2536577057e97f23f75a202e26d0e86cf01
https://nvd.nist.gov/vuln/detail/CVE-2026-81004
https://www.cve.org/CVERecord?id=CVE-2026-81004

History

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://nvd.nist.gov/vuln/detail/CVE-2026-81004 https://www.cve.org/CVERecord?id=CVE-2026-81004
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Cancel work cleanly on an error If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed.
Title		ipmi:msghandler: Cancel work cleanly on an error
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/99692252b348c11377fd0cdd66b6b18f3b22758e https://git.kernel.org/stable/c/a496c51dd3257ed7e00873af2ad9bb22c3ddc4cf https://git.kernel.org/stable/c/ae84a2536577057e97f23f75a202e26d0e86cf01