Linux Kernel CVE-2026-46128

The Linux kernel IPMI (Intelligent Platform Management Interface) subsystem provides a standard protocol interface to the BMC - a dedicated embedded processor on server hardware used for out-of-band management, environmental monitoring, and event logging. The vulnerable code path handles event message buffer responses returned by the BMC: rather than validating the response data size immediately upon receipt, the check is deferred to later processing logic. CPE data (cpe:2.3:o:linux:linux_kernel) confirms the issue exists from kernel 2.6.12 onward. No CWE is formally assigned, but the root cause class aligns with CWE-20 (Improper Input Validation) - specifically, trusting externally-supplied hardware data without early boundary checking. The fix adds an early validation guard immediately after the BMC response is received, before any further parsing occurs.