EUVD-2026-76329
GHSA-6fj7-8rgr-8w36
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because triggering the maintenance_mode sysfs creation failure is not reliably user-directed without additional local primitives; all other metrics align with kernel UAF impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Remove all sysfs files on registration failure
ipmi_add_smi() creates the nr_users and nr_msgs files before trying to create the maintenance_mode file. If that last creation fails, the error path removes only nr_users before dropping the final reference to the interface.
Remove nr_msgs as well so no sysfs attribute embedded in the freed interface remains registered.
AnalysisAI
Use-after-free in the Linux kernel IPMI subsystem exposes freed kernel memory through a stale sysfs attribute left behind after a failed SMI registration. When ipmi_add_smi() encounters an error creating the maintenance_mode sysfs file, the nr_msgs attribute is not removed before the smi_info interface structure is freed, leaving a dangling sysfs entry backed by released memory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a local user account with shell access on the target system (PR:L per CVSS vector); (2) the IPMI kernel subsystem modules (e.g., ipmi_si, ipmi_msghandler) to be loaded, which presupposes IPMI-capable hardware or emulation; (3) a triggering event where ipmi_add_smi() executes and the maintenance_mode sysfs creation specifically fails - this is a transient, error-condition-dependent path most plausibly reachable under out-of-memory scenarios and not directly user-controllable without additional local primitives; and (4) correct timing to access the dangling nr_msgs sysfs attribute before the freed memory is reallocated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) captures a credible worst-case kernel UAF impact, but AC:L appears optimistic: triggering the maintenance_mode sysfs creation failure within ipmi_add_smi() requires a kernel-level error condition (most plausibly an out-of-memory event) that is not directly controllable by an unprivileged user in a reliable, repeatable fashion. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Linux kernel 6.18.50 and 7.2.4 (stable series), with the fix also merged into 7.3-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify all Linux systems with IPMI enabled and determine which ones allow unprivileged local user accounts; flag systems with both as highest priority. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today