CVE-2026-81005 Linux CVE debrief

Who should care

Linux kernel developers, administrators responsible for maintaining and securing Linux-based systems, and security teams should review and apply the patch, verify IPMI message handler configurations, and monitor system logs for potential exploitation attempts. Additionally, operators and platform teams should be aware of the potential impact on system availability and reliability.

Why it matters

This vulnerability in the Linux kernel's IPMI message handler could lead to system crashes or instability if exploited. Linux kernel developers and administrators should review and apply the patch, verify IPMI message handler configurations, and monitor system logs for potential exploitation attempts.

• Potential system crashes or instability due to NULL pointer dereferences
• Increased risk of exploitation attempts due to publicly available vulnerability information
• Need for patching and verification of IPMI message handler configurations
• Potential impact on system availability and reliability

Technical summary

The vulnerability occurs in the Linux kernel's IPMI message handler, specifically in the ipmi_add_smi() function. When the BMC device returns a nonzero completion code to the Get Device ID command, the function logs an error and invokes the lower driver's shutdown callback. However, the intf->in_shutdown flag is not set on this failed-registration rollback path, allowing the asynchronous redo_bmc_reg work item to retry BMC device-id probing after the lower driver has already cleared its SI state machine data.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patch to the Linux kernel
• Verify the IPMI message handler configuration
• Monitor system logs for potential exploitation attempts
• Perform a thorough review of system configurations and IPMI message handler settings
• Check for any existing compensating controls that may mitigate the vulnerability
• Inventory affected systems and prioritize patching based on criticality
• Track changes and updates to the Linux kernel and IPMI message handler

Evidence notes

The vulnerability was resolved by setting intf->in_shutdown on the out_err_started path before invoking the lower driver's shutdown callback. This prevents later redo_bmc_reg retries from using an interface whose lower driver state has been cleaned up.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.