EUVD-2026-76327
GHSA-7w62-wjr5-jwfq
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector with high complexity to trigger the startup error path; PR:L reflects the elevated privileges (root or CAP_SYS_MODULE) needed to manipulate IPMI module state.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipmi:msghandler: Cancel work cleanly on an error
If an error occurs during startup of an IPMI interface, it may have scheduled work to run. The work needs to be canceled before the interface can be freed.
AnalysisAI
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) a system with IPMI-capable hardware, typically enterprise servers or workstations with a Baseboard Management Controller; (2) the ipmi_msghandler kernel module loaded; (3) the ability to trigger an error condition during IPMI interface startup, most plausibly by inducing module reload, device hotplug, or device removal/reinsertion with elevated privileges (root or CAP_SYS_MODULE). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.4) overstates exploitability in two dimensions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 6.18.50 or later for the 6.18.x stable series, or kernel 7.2.4 or later for the 7.x series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit your infrastructure to identify systems with IPMI hardware enabled and kernel versions in the 6.18 or 7.x ranges; create a prioritized list focused on production and security-critical servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today