CVE-2026-81006

The Linux kernel's IPMI driver fails to fully clean up when interface registration goes wrong: ipmi_add_smi() creates the nr_users and nr_msgs sysfs files before attempting to create maintenance_mode, and if that last creation fails, the error path removes only nr_users before dropping the final reference and freeing the interface structure. The nr_msgs attribute, which is embedded in that freed structure, therefore remains registered in sysfs and points into freed kernel memory. A local low-privileged attacker who can induce this registration failure and then access the orphaned nr_msgs file would be reading or manipulating freed kernel memory, which can crash the system or leak/corrupt kernel data and plausibly escalate privileges (CVSS 3.1: 7.8, AV:L/AC:L/PR:L with high impact to confidentiality, integrity, and availability). The flaw affects Linux systems running kernels with the IPMI message handler code, which is typically active on servers and other machines with BMC/IPMI management hardware. No public proof of concept or in-the-wild exploitation is known, the issue is not on the CISA KEV list, and the fix removes nr_msgs in the error path so no attribute embedded in the freed interface remains registered.

What to do: Apply kernel updates from your distribution as soon as a release containing the ipmi error-path fix (removal of nr_msgs) is available. Because exploitation requires local access with low privileges, restrict untrusted local accounts and monitor for failures during IPMI interface registration followed by accesses to stale nr_msgs entries. On systems without IPMI/BMC hardware, consider blacklisting the ipmi_si and ipmi_msghandler kernel modules to remove the vulnerable code path entirely.