Linux kernel IPMI: refcount leak on the supplied-recv error path permanently pins the IPMI user

Impact

When a caller passes its own recv message to i_ipmi_request(), the function bumps the user's nr_msgs and takes a kref, but the out_err path only cleans up messages the function allocated itself. In the supplied-recv case the counts are never reverted and ipmi_request_supply_msgs() does not release it either, so every failed request permanently consumes one slot against that user's in-flight message limit and holds a reference on the IPMI user object. A process that loops on requests failing after that point can wedge its own IPMI channel until reboot, which matters on a GPU node because host-side IPMI is how fleet tooling reads inlet temperature, PSU and DIMM health and talks to the BMC - the telemetry you would use to decide whether to pull the node. This is a resource leak; the record shows no memory corruption or privilege escalation.

Who can reach it

Local only, and effectively privileged: a process able to open /dev/ipmi* - root on a standard install, or a monitoring container that has the device mapped in - issuing requests that fail after the reference is taken. Not reachable over the network and not reachable by an ordinary tenant pod without that device.

What to do

Take a stable kernel containing the fix (commits linked in the record) and reboot. The elevated counts and leaked krefs cannot be reclaimed at runtime, so an already-affected node needs a reboot either way; treat it as a routine drain-and-reboot rather than an emergency window. No vendor fixed-version numbers appear in the record beyond the stable commits.

References

Related entries

• Linux kernel i2c-mlxbf (BlueField DPU I2C controller): mlxbf_i2c_init_resource() frees a resource struct and then readsCVE-2026-72140 · Linux kernel i2c-mlxbf (BlueField DPU I2C controller)Unscored
• Linux kernel mlxsw: failed LAG index allocation leaks a LAG reference on Spectrum switchesCVE-2026-72308 · Linux kernel mlxsw (Spectrum switch driver, LAG join error path)Unscored
• Linux kernel bnxt_re: uninitialised shared page mapped to userspace leaks kernel memoryCVE-2026-74584 · Linux kernel bnxt_re RDMA driver (ucontext shared page)Unscored
• Linux kernel PMBus hwmon: type confusion in the alert path reads past the attribute allocationCVE-2026-74711 · Linux kernel hwmon pmbus core (pmbus_notify attribute type confusion)Unscored
• Linux kernel hns_roce: bonding teardown order leaks resources and leaves a stale netdev notifierCVE-2026-80625 · Linux kernel hns_roce (RoCE bonding resource teardown order)Unscored
• Linux kernel Soft-RoCE: modify_qp frees the rd_atomic array using the new size, writing out of boundsCVE-2026-80863 · Linux kernel RDMA/rxe (free_rd_atomic_resources during modify_qp)Unscored