Linux kernel ipmi/ipmb: unvalidated write length reads uninitialized stack and underflows block length

Impact

ipmb_write() parsed message fields before validating the length byte, so a zero-length or short write reads uninitialized stack bytes, and a length below the SMBus header size underflows the block write length. Exposure is local: it needs write access to the IPMB character device, which on a datacenter host is normally root or a BMC-management group. The practical concern is on nodes where a management agent or in-band IPMI tooling holds that device - the disclosure is small and the record does not claim memory corruption beyond the underflow.

Who can reach it

Local user able to write to the IPMB device node. No remote path. On a headless GPU node the ipmb driver is usually not even loaded, which removes the exposure entirely.

What to do

Pick up the stable kernel carrying the fix (four backport commits are linked) and reboot the node; there is no runtime mitigation short of unloading or blacklisting the ipmb module where in-band IPMB is not used. On a GPU fleet that means a drain and reboot per node, so fold it into the next scheduled kernel window rather than an emergency one.

References

Related entries

• Linux kernel ipmi: use-after-free of cmd_rcvr when an IPMI user is destroyedCVE-2026-89486 · Linux kernel IPMI message handler (cmd_rcvr RCU teardown)Unscored
• ASPEED BMC (host-to-BMC bridges generally): The ASPEED LPC/PCIe bridge architecture exists to let the host talkNCVD-0000-001-aspeed-bmc-host-to-bmc-bridges-g · ASPEED BMC (host-to-BMC bridges generally)Unscored
• IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingNCVD-0000-002-ipmi-over-lan-as-a-protocol · IPMI over LAN as a protocolUnscored
• Internet-exposed BMC: Shodan-visible BMCs are a recurring finding at colo/neocloud buildoutsNCVD-0000-003-internet-exposed-bmc · Internet-exposed BMCUnscored
• InfiniBand subnet manager (OpenSM / UFM): The IB subnet manager has unilateral authority over LID assignment, routingNCVD-0000-004-infiniband-subnet-manager-opensm · InfiniBand subnet manager (OpenSM / UFM)Unscored
• RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentNCVD-0000-005-rdma-roce · RDMA / RoCEUnscored