CVE-2026-81007

The ipmb_write() function in the Linux kernel's IPMI IPMB character driver (ipmi_ipmb) parsed message fields before validating the length byte supplied by the caller. A local attacker with write access to the IPMB device node can trigger the bug with a zero-length or truncated write: the kernel then reads uninitialized stack bytes (information disclosure, C:H in the CVSS vector), and a length value smaller than the SMBus header underflows the block-write length, which can crash or destabilize the system (A:H). The affected population is Linux systems where the ipmi_ipmb driver is loaded and bound to an SMBus/IPMB interface — typically servers and embedded boards with a baseboard management controller (BMC) — rather than typical desktops or laptops. The upstream fix requires a non-empty buffer and the minimum IPMB request length before any message parsing occurs. No public proof of concept is known, the issue is not in CISA's KEV catalog, and no exploitation in the wild has been reported.

What to do: Update to a kernel release containing the upstream 'ipmi: ipmb: validate write message length' fix, or apply your distribution's stable kernel update once it ships. Check whether the ipmi_ipmb module is loaded and whether its device node exists; if the IPMB interface is unused, blacklist the module and keep the device node restricted to root. Because exploitation requires local access with low privileges, limiting local account access and monitoring for abnormal writes to the IPMB device further reduces risk.