Linux kernel ipmi/ipmb: unvalidated write length reads uninitialized stack and underflows block length

UnscoredCVE-2026-81007Firmware, BMC & network fabriccurated

Impact

ipmb_write() parsed message fields before validating the length byte, so a zero-length or short write reads uninitialized stack bytes, and a length below the SMBus header size underflows the block write length. Exposure is local: it needs write access to the IPMB character device, which on a datacenter host is normally root or a BMC-management group. The practical concern is on nodes where a management agent or in-band IPMI tooling holds that device - the disclosure is small and the record does not claim memory corruption beyond the underflow.

Who can reach it

Local user able to write to the IPMB device node. No remote path. On a headless GPU node the ipmb driver is usually not even loaded, which removes the exposure entirely.

What to do

Pick up the stable kernel carrying the fix (four backport commits are linked) and reboot the node; there is no runtime mitigation short of unloading or blacklisting the ipmb module where in-band IPMB is not used. On a GPU fleet that means a drain and reboot per node, so fold it into the next scheduled kernel window rather than an emergency one.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-81007 https://git.kernel.org/stable/c/53637506884dbd5c91a89b1a3547d99d80f8ed2c https://git.kernel.org/stable/c/5719431ca2b5fa26560bb38f6202f8b97fa3bbb0 https://git.kernel.org/stable/c/a84c6e3d188f2c6e674910929eb790634299d6d5

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.