EUVD-2026-76330
GHSA-7w7r-xvw6-m4c6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local IPMB device write access requires PR:L; stack disclosure rates C:H; integer underflow enables kernel crash so A:H; no confirmed write/integrity primitive.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipmi: ipmb: validate write message length
ipmb_write() read message fields before validating the length byte.
A zero or short write can read uninitialized stack bytes.
A length smaller than the SMBus header underflows the block write length.
Require a non-empty buffer and the minimum IPMB request length.
Also require the length byte plus payload before parsing the message.
AnalysisAI
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in ipmb_write(). The root cause is that ipmb_write() parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target system has IPMI ipmb-capable BMC hardware physically present (e.g., server motherboards with IPMB/I2C bus to the BMC); (2) the Linux ipmb kernel module is loaded (not loaded by default on most distributions); (3) the attacker has a local unprivileged account with write access to the IPMB character device node (PR:L - typically group or world-writable, or accessible via a service account with device privileges). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (7.1 High) is consistent with the described primitives: local access is required (AV:L), low privileges are sufficient to open the IPMB device node (PR:L), and exploitation is straightforward once access exists (AC:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched kernel release: 6.12.109, 6.18.50, 7.2.4, or any build from the 7.3-rc1 tree. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux servers in your environment running IPMI or baseboard management controllers and assess whether untrusted local users have access to IPMB device nodes. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today