Linux kernel ipmi_msghandler: nr_msgs sysfs file survives a failed interface registration

UnscoredCVE-2026-81006Firmware, BMC & network fabriccurated

Impact

ipmi_add_smi() creates the nr_users and nr_msgs sysfs files before it creates maintenance_mode. If that last creation fails, the error path removes only nr_users and then drops the final reference to the interface, leaving a sysfs attribute registered against freed memory. Anything that later reads that file touches a dangling object. As with the sibling startup-error bug, nothing in the record describes tenant-reachable input: it needs an IPMI registration failure on the host. The operator-facing consequence on a GPU node is a possible host crash around BMC driver initialisation, which takes the accelerators with it.

Who can reach it

Local. Requires an ipmi_add_smi() registration failure on the host; reaching it deliberately means already having the privilege to load kernel modules. No authenticated remote or tenant path is described.

What to do

Apply the stable kernel update containing the fix (three stable commits linked in the record) and reboot the node. No standalone mitigation is given; the exposure exists only while the IPMI stack is loaded, so nodes that do not use in-band IPMI can unload it, but that is not the normal datacenter configuration. The record names no distribution package version.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-81006 https://git.kernel.org/stable/c/b115b7d06f26b3f000d2afda88acb54c7a7cb2c9 https://git.kernel.org/stable/c/b6c46ab0bdee90c238e96ea4a74972118c97900d https://git.kernel.org/stable/c/d46c97eddcbc53ca885e8bb359930c58884616ff

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.