PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46044 Linux CVE debrief

A resource leak vulnerability exists in the Linux kernel's IPMI SSIF (System Management Interface - SMBus System Interface) driver. If an error occurs after the SSIF kernel thread is created but before the main IPMI code starts the SSIF interface, the kernel thread is not properly stopped, leading to a dangling kthread. This can result in resource exhaustion or system instability over repeated error conditions. The vulnerability has been resolved by ensuring the kthread is stopped on error conditions when running.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-19
Advisory published
2026-05-27
Advisory updated
2026-06-19

Who should care

System administrators managing servers with IPMI SSIF interfaces, Linux distribution maintainers, and organizations running custom kernel builds with IPMI support should prioritize this patch to prevent potential resource exhaustion in error scenarios.

Technical summary

The IPMI SSIF driver in the Linux kernel creates a kernel thread during initialization. If an error occurs after kthread creation but before the SSIF interface is fully started by the main IPMI code, the error handling path fails to stop the created kthread. This results in a resource leak where the kthread continues running without proper cleanup. The fix ensures that kthread_stop() is called on the error path when the thread is running, preventing the resource leak.

Defensive priority

medium

Recommended defensive actions

  • Apply the relevant stable kernel patches from the 5.15, 6.1, and 6.6 stable trees once available through your distribution's security channel
  • Monitor NVD for CVSS scoring updates as analysis progresses
  • Review systems using IPMI SSIF interfaces for kernel thread resource usage if experiencing stability issues
  • Verify kernel thread cleanup behavior in custom IPMI SSIF driver implementations if maintaining out-of-tree code

Evidence notes

The vulnerability description is sourced from the official CVE record and NVD entry. Three kernel.org stable tree commits are referenced as the resolution. No CVSS score or severity rating has been assigned by NVD at this time (status: Awaiting Analysis). The vendor identification is marked as low confidence and requires review, though the source references clearly indicate the Linux kernel.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46044 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46044

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46044 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46044

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/75c486cb1bcaa1a3ec3a6438498176a3a4998ae4

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/800febc637d1c1974b1e899dea8a07e115d60766

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/858bc8b9edb6eaf0522900128bb9053e2df6b0f6

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.