Linux kernel ipmi_msghandler: work item left scheduled when interface startup fails, freeing live state

Impact

Every server node with a BMC loads the kernel IPMI stack, and GPU nodes are no exception - it is how the host reads inlet temperature, power draw and sensor state. If an IPMI interface fails part way through startup, the driver frees the interface without cancelling work it has already scheduled, so a queued work item can run against freed memory. The record gives no attacker-controlled trigger: it fires on a startup error, typically from a misbehaving or slow BMC, not from anything a tenant can send. Realistic worst case is a kernel crash on a node during boot or driver reload, which on a GPU host means an unplanned outage of the whole box rather than a tenant-visible compromise.

Who can reach it

Local and indirect. No network or tenant path is described: the path needs an IPMI interface registration to fail on the host. Anyone able to load or reload the IPMI modules is already root; a flaky BMC can reach it with no attacker at all.

What to do

Take the stable kernel update that carries the fix (three stable commits linked in the record) and reboot each node. No configuration mitigation is described. Operators who do not need in-band IPMI can avoid the path entirely by not loading ipmi_msghandler/ipmi_si, but on most fleets that is what feeds hardware telemetry, so the practical answer is a kernel roll with a normal drain-and-reboot window. No vendor advisory with a fixed release number is present in the record.

References

Related entries

• Linux kernel ipmi_si: NULL pointer dereference after a failed IPMI interface registrationCVE-2026-81005 · Linux kernel ipmi_si / ipmi_msghandler (failed BMC registration path)Unscored
• Linux kernel ipmi_msghandler: nr_msgs sysfs file survives a failed interface registrationCVE-2026-81006 · Linux kernel IPMI message handler (ipmi_add_smi sysfs attribute cleanup)Unscored
• Linux kernel ipmi/ipmb: unvalidated write length reads uninitialized stack and underflows block lengthCVE-2026-81007 · Linux kernel IPMI IPMB driver (ipmb_write length validation)Unscored
• Linux kernel ipmi: use-after-free of cmd_rcvr when an IPMI user is destroyedCVE-2026-89486 · Linux kernel IPMI message handler (cmd_rcvr RCU teardown)Unscored
• Linux kernel RDMA/ucma: unprivileged event-list corruption when a context is migrated mid-writeCVE-2026-89507 · Linux kernel RDMA/ucma (ucma_write_cm_event, /dev/infiniband/rdma_cm)Unscored
• Linux kernel RDMA/ucma: use-after-free on the event list when SET_OPTION races context migrationCVE-2026-89508 · Linux kernel RDMA/ucma (ucma_set_ib_path / SET_OPTION path)Unscored