CVE-2026-72042 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining and securing Linux-based systems, and security teams should care about this vulnerability as it affects the IPMI event delivery system in the Linux kernel. They should review the Linux kernel source code, check for affected systems, and apply necessary patches. Additionally, they should monitor the system for suspicious activity related to IPMI event delivery and review compensating controls for exposed systems while remediation is scheduled and verified. This includes verifying the vulnerability's impact on managed environments, assigning owners for follow-up, and tracking exceptions and retesting remediated assets. The vulnerability's impact on operator, platform, vulnerability-management, and security-team processes should also be assessed to ensure proper mitigation and response planning are in place to address potential exposures and minimize risk effectively across the organization. This requires collaboration between development, operations, and security teams to ensure comprehensive coverage and effective remediation strategies are implemented to protect against potential exploitation and maintain system integrity and security posture in light of this vulnerability in the Linux kernel's IPMI event delivery system. Therefore, it is crucial for Linux kernel developers and administrators to prioritize this vulnerability and take immediate action to mitigate its impact on their systems and ensure the security and integrity of their Linux-based systems and infrastructure. This involves not only applying patches but also conducting thorough reviews of system configurations, monitoring for potential exploitation attempts, and implementing compensating controls where necessary to minimize risk until patches can be applied. By taking these steps, Linux kernel developers and administrators can help prevent potential attacks and maintain the security and stability of their systems. Furthermore, security teams should also be involved in the remediation process to ensure that security protocols are updated and that incident response plans are in place in case of an attack. Overall, a coordinated and

Technical summary

The vulnerability is caused by an extra put in the rollback path of handle_read_event_rsp() that drops user->refcount explicitly after freeing each message. This can cause a user that remains linked on intf->users to be freed, leading to later event delivery dereferencing a freed user or triggering refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference.

Defensive priority

Medium

Recommended defensive actions

• Review the Linux kernel source code and the IPMI event delivery system to understand the vulnerability
• Check for any affected systems and apply the necessary patches
• Monitor the system for any suspicious activity related to IPMI event delivery
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by an extra put in the rollback path of handle_read_event_rsp() that drops user->refcount explicitly after freeing each message. To verify, review the Linux kernel source code and the IPMI event delivery system. Check for any affected systems and apply the necessary patches.

Official resources