CVE-2026-72040 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux system administrators, and users of IPMI-enabled systems, particularly those with IPMI subsystems, should review and apply the provided kernel patches to fix the refcount leak vulnerability. They should also monitor Linux kernel updates for further fixes and advisories, and assess potential exposure by inventorying Linux systems for IPMI usage. Additionally, they should consider compensating controls for exposed systems while remediation is scheduled and verified, and track exceptions, retest remediated assets, and close the item only after evidence is documented. Those responsible for vulnerability management and security teams should prioritize this vulnerability based on its potential operational impact and source-confidence limits. Those responsible for monitoring, detection, and logs should check relevant data for exposed assets that need extra review. Those responsible for asset inventory and change management should ensure that affected product deployments are identified and prioritized for remediation. Those responsible for incident response and threat hunting should be aware of potential exploitation attempts and have plans in place for rapid response and mitigation. Those responsible for patch management and configuration management should ensure that patches are applied and configurations are updated to prevent exploitation. Those responsible for risk management and compliance should assess the potential risks and ensure that necessary controls are in place to mitigate them. Those responsible for security awareness and training should ensure that relevant personnel are aware of the vulnerability and its potential impact, and provide training on how to respond to and mitigate it. Those responsible for incident response planning should review and update their plans to include this vulnerability and ensure that they have the necessary resources and procedures in place to respond to potential exploitation attempts. Those responsible for supply chain risk management should assess the potential impact on their supply chain and ensure that their suppliers are aware of the vulnerability and are taking necessary

Technical summary

The Linux kernel's IPMI subsystem has a refcount leak vulnerability. When a caller provides a `supplied_recv` message to `i_ipmi_request()`, the function increments the user's `nr_msgs` reference count. However, in case of an error, the out_err cleanup path does not free the recv_msg if it was supplied by the caller, resulting in a permanent reference count leak. This vulnerability can be fixed by explicitly reverting the reference count operations when a supplied recv_msg with a valid user pointer is present in the error path.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the provided kernel patches to fix the refcount leak vulnerability
• Monitor Linux kernel updates for further fixes and advisories
• Inventory Linux systems for IPMI usage and assess potential exposure
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details about the vulnerability. However, the source detail is limited, and further verification is needed to determine the full scope of the vulnerability. Affected Linux kernel developers and maintainers should verify the IPMI subsystem's reference count operations. The vulnerability can be fixed by explicitly reverting the reference count operations when a supplied recv_msg with a valid user pointer is present in the error path. Linux system administrators and users of IPMI-enabled systems should review and apply the provided kernel patches to fix the refcount leak vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.