CVE-2026-81004

The Linux kernel's IPMI message handler (ipmi_msghandler) fails to cancel work items it has already scheduled when an error occurs during startup of an IPMI interface, allowing that work to run after the interface structure has been freed — a use-after-free. The flaw is triggered when IPMI interface initialization fails after work has been queued, which can occur on systems with BMC/IPMI hardware where the driver errors out during probe or interface registration. A local attacker who can reach this path could achieve kernel memory corruption with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.4, AV:L/AC:L/PR:N), potentially enabling privilege escalation or denial of service. Affected systems are Linux machines running kernels with the IPMI driver, most commonly x86 servers with baseboard management controllers. No public proof of concept is known and there is no evidence of exploitation in the wild.

What to do: Apply your distribution's kernel update once it includes the upstream fix that cancels scheduled work on IPMI interface startup errors, then reboot. Check whether the driver is in use on servers (e.g., 'lsmod | grep ipmi') and prioritize multi-tenant or shared hosts, since the attack vector is local and requires no privileges. Practical risk is limited because exploitation depends on inducing a startup-error condition, so patching on the normal kernel maintenance cadence is reasonable.