CVE-2026-89486

The Linux kernel's IPMI message handler contains a use-after-free in _ipmi_destroy_user(): commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() grace period between unlinking entries from intf->cmd_rcvrs and freeing them, even though that list is still read under plain RCU by find_cmd_rcvr() and handle_ipmb_get_msg_cmd(). If an IPMI user is destroyed while another CPU concurrently processes an incoming IPMB message, the reader can still hold a pointer to a cmd_rcvr that has been kfree()d, resulting in kernel memory corruption. A local attacker with low privileges who can win this race could escalate privileges to root or crash the system (CVSS 3.1: 7.8, AV:L/PR:L with high confidentiality, integrity, and availability impact). Affected systems are those running kernels that include the offending commit with the IPMI message handler active, which in practice means physical servers and similar managed hardware with BMC/IPMI support. No public proof of concept exists and the flaw is not in CISA's KEV catalog, so exploitation is not known to have occurred.

What to do: Update to a kernel containing the fix (it restores synchronize_rcu() in _ipmi_destroy_user()) as soon as your distribution ships it, and prioritize servers where untrusted local users or containers exist. Verify that /dev/ipmi* device nodes are restricted to root or a dedicated group so unprivileged users cannot open IPMI handles. Watch for kernel oopses or panics referencing ipmi_msghandler, handle_ipmb_get_msg_cmd(), or _ipmi_destroy_user(), which would signal attempted triggering of the race.