PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46108 Linux CVE debrief

A state management vulnerability in the Linux kernel's IPMI System Interface (SI) driver could cause the driver to become unresponsive when message allocation fails. The flaw occurs because the driver fails to return to a normal operational state after certain message allocation failures, leaving the IPMI interface stalled. The fix ensures proper state recovery to maintain driver availability.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-25
Advisory published
2026-05-28
Advisory updated
2026-06-25

Who should care

System administrators managing servers with IPMI BMC interfaces; Linux kernel maintainers; organizations relying on out-of-band server management capabilities

Technical summary

The IPMI System Interface (SI) driver in the Linux kernel contains a state management defect where message allocation failures do not properly return the driver to normal operational state. This can result in the driver becoming stalled and unresponsive. The vulnerability is triggered when memory allocation for IPMI messages fails under resource pressure or error conditions. The resolution adds proper state restoration logic to ensure the driver recovers to normal state after allocation failures, maintaining interface availability.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable branch commits when available through distribution channels
  • Monitor IPMI SI driver functionality on systems where kernel updates cannot be immediately applied
  • Review system logs for IPMI-related stalls or unresponsiveness that may indicate trigger conditions

Evidence notes

The vulnerability description indicates that message allocation failures in the IPMI SI driver could leave the driver in a non-functional state without proper recovery. The fix adds state restoration to normal operational mode when allocation fails. Multiple stable kernel branch commits are referenced, indicating backports to supported kernel versions.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46108 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46108

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46108 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46108

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/09dd798270ff582d7309f285d4aaf5dbebae01cb

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/88881dc1da86064f479378bc9d0a4956c3d0bb12

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ba60140d4133231b49185ac8bf6e54f318d3134e

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bc13fce9eeec88c4950924754c3347c6dc66ff4c

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ce905b65e649eee378a0f37e8219f1d70efb3007

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.