Linux kernel ipmi_si: NULL pointer dereference after a failed IPMI interface registration

Impact

When the BMC does not answer Get Device ID, ipmi_add_smi() fails and calls the low-level shutdown callback, which frees smi_info->si_sm and NULLs it. intf->in_shutdown is never set on that rollback path, so the asynchronous redo_bmc_reg work item can still run afterwards and passes the NULL state-machine pointer into start_kcs_transaction(), panicking the host. The trigger is a BMC that is wedged, mid-reset or slow during boot - a routine condition on a dense GPU node where the service processor is also driving fan and power telemetry. The failure lands at driver init, so the cost is a host that will not come up cleanly rather than a running workload lost, but it turns a recoverable BMC glitch into a node that needs hands-on attention.

Who can reach it

Local and hardware-driven: the host's own BMC returning a nonzero completion code to Get Device ID during ipmi_si probe. No user login and no network reachability to the host are required; anyone able to reset or wedge the BMC over the management VLAN is in a position to induce it.

What to do

Pick up the stable kernel with commit 53af3a8bae0a (or the equivalent backport) and reboot the node; the fix is in the driver init path so a running kernel cannot be corrected in place. Where a kernel update is not imminent, not auto-loading ipmi_si on nodes whose BMC is unstable avoids the path, at the cost of losing in-band IPMI.

References

Related entries

• Linux kernel ipmi/ipmb: unvalidated write length reads uninitialized stack and underflows block lengthCVE-2026-81007 · Linux kernel IPMI IPMB driver (ipmb_write length validation)Unscored
• Linux kernel ipmi: use-after-free of cmd_rcvr when an IPMI user is destroyedCVE-2026-89486 · Linux kernel IPMI message handler (cmd_rcvr RCU teardown)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored