Linux Kernel EUVD-2026-59000

Exploitation requires all of the following concurrent conditions: (1) local shell access with at minimum an unprivileged user account (PR:L); (2) a Linux kernel version in the affected range across 6.1, 6.6, 6.12, 6.17, or 6.18 stable branches; (3) physical IPMI/BMC hardware present in the system, such that the ipmi_msghandler kernel module is loaded and functional; (4) the specific error-rollback path in handle_read_event_rsp() must be triggered - this occurs when event delivery fails after successfully allocating receive messages for at least one user but before completing allocation for all registered users, requiring multiple IPMI users to be registered simultaneously. Systems without IPMI hardware (most desktops, laptops, VMs, and cloud instances) are not affected regardless of kernel version. The lack of a race condition in the traditional sense means timing is less critical than deliberately inducing the allocation-failure mid-path condition, but this still requires controlled interaction with the IPMI subsystem rather than a passive trigger.

The CVSS 3.1 score of 7.8 (High) accurately captures the theoretical impact - a local low-privilege attacker who successfully triggers the bug can achieve kernel memory corruption yielding full confidentiality, integrity, and availability compromise. However, several signals indicate this is not an emergency-tier vulnerability for most organizations. EPSS at 0.20% (10th percentile) reflects very low exploitation probability in the current threat landscape, with no CISA KEV listing and no public POC identified. The vulnerability is constrained to systems with physical IPMI hardware (a BMC) and the ipmi_msghandler module loaded and active - a hardware prerequisite that eliminates most desktop, laptop, and cloud-VM deployments from scope. The error-rollback path requires a specific failure condition during multi-user event delivery, suggesting non-trivial triggering compared to a straightforward single-step flaw. Even a mid-sized municipal IT team in gliwice running Linux-based bare-metal server infrastructure with BMC management enabled should treat patching as a planned maintenance priority rather than an emergency response, given the local-access-only attack vector and hardware dependency. The CVSS vector is internally consistent with the description; no signal conflicts are observed, though the absence of a formal CWE assignment means root-cause classification is inferred from the patch description rather than confirmed by NVD.

A local attacker with a standard shell account on a Linux bare-metal server running an unpatched kernel opens the IPMI device, registers as an IPMI user, and crafts a sequence of IPMI event operations that causes handle_read_event_rsp() to fail mid-way through multi-user message allocation, deliberately triggering the error-rollback path. The stale double-put frees the ipmi_user object while it remains on intf->users; the attacker then triggers a subsequent IPMI event delivery that dereferences the freed object, achieving kernel memory corruption that can be leveraged for privilege escalation to root. No public POC exists at time of analysis, increasing the practical difficulty of this scenario.