PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46177 Linux CVE debrief

A vulnerability in the Linux kernel's IPMI driver could allow a misbehaving Baseboard Management Controller (BMC) to cause denial of service through unbounded event/message fetching loops. The driver previously lacked limits on how many events or messages it would fetch from the BMC in a single operation, and could become stuck if the BMC's attention bit remained asserted. The fix introduces a hard limit of 10 fetches per operation and allows message processing between flag fetches to prevent driver stalls.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-30
Advisory published
2026-05-28
Advisory updated
2026-05-30

Who should care

System administrators managing servers with IPMI/BMC functionality; Linux distribution maintainers; organizations running infrastructure with out-of-band management capabilities

Technical summary

The Linux kernel IPMI driver previously would fetch events and receive messages from the BMC without limit until the BMC indicated completion. A misbehaving BMC that never signaled completion could cause the driver to loop indefinitely. Additionally, if the SI interface attention state bit became stuck, the driver could become unresponsive. The resolution adds a maximum of 10 fetches per operation and permits message processing between flag fetches to ensure forward progress regardless of BMC state.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available for your distribution
  • Monitor for kernel package updates addressing CVE-2026-46177
  • Review BMC firmware for known issues if experiencing IPMI driver hangs
  • Consider BMC firmware updates from hardware vendors if available

Evidence notes

The vulnerability description indicates this is a defense-in-depth fix for BMC misbehavior rather than an exploitable security flaw in the traditional sense. No CVSS score has been assigned. The fix is described as 'more general' than a previous targeted fix for a specific bad BMC.

Official resources

The vulnerability was disclosed via the Linux kernel stable tree on 2026-05-28. The issue has been present since the driver's inception and represents a robustness improvement rather than a traditional code bug, accounting for defective BMC