EUVD-2026-76392
GHSA-6jq9-cvjw-v2h5
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AV:L and PR:L match IPMI driver local user requirement; AC:H reflects the race-condition timing sensitivity required to reliably trigger the UAF; C/I/A:H for full kernel memory corruption potential.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() between unlinking the command receivers from intf->cmd_rcvrs and freeing them, updating only the comment that explains why the barrier is needed.
The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr() walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a reader still holds a pointer to it, causing a use-after-free.
The rework only made srcu unnecessary for the interfaces list; the cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu() before freeing the receivers.
AnalysisAI
Use-after-free in the Linux kernel IPMI message handler allows a local low-privileged user to corrupt kernel memory by racing _ipmi_destroy_user() against concurrent RCU readers in find_cmd_rcvr() and handle_ipmb_get_msg_cmd(). A regression introduced by commit 9e91f8a6c868 removed the synchronize_rcu() grace period that previously ensured no readers held live pointers to cmd_rcvr structures before kfree() was called, while the cmd_rcvrs list continues to be walked under plain RCU. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local shell access with at least low-privilege user rights on the target host (AV:L, PR:L per CVSS); (2) the `ipmi_msghandler` kernel module must be loaded and a functional IPMI device must be accessible - this is standard on physical servers with BMC hardware (HP iLO, Dell iDRAC, Supermicro IPMI, etc.) but absent on most desktop systems, containers, and VMs without BMC passthrough; (3) the running kernel must contain regressing commit 9e91f8a6c868 but not one of the three corrective fix commits; (4) the attacker must win a race between `_ipmi_destroy_user()` freeing a `cmd_rcvr` and a concurrent RCU read-side critical section still holding a pointer to the same structure, which requires timing precision. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields 7.8, reflecting a local low-privileged exploitation path with full C/I/A impact potential consistent with a kernel UAF that could be turned into privilege escalation or kernel panic. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched Linux kernel: version 6.18.50, 7.2.4, or 7.3-rc1 (or later), which restore `synchronize_rcu()` in `_ipmi_destroy_user()` before freeing `cmd_rcvr` structures. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of Linux systems using IPMI functionality and determine their current kernel versions by consulting your patch management database or directly querying systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today