CVE-2026-72042

Received Received - Intake

IPMI User Refcount Underflow in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg(). That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference. Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72042

EUVD

EUVD-2026-59000

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a user reference count underflow occurs during IPMI event delivery. When event delivery fails, the system incorrectly drops a user reference twice, potentially freeing a user object that is still linked in the interface's user list. This can lead to use-after-free issues or refcount warnings when the system tries to access or reference the freed user.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPMI subsystem and requires kernel-level detection. Check if your system uses IPMI by running: lsmod | grep ipmi. If loaded, monitor kernel logs for refcount warnings or crashes related to IPMI event handling.

Impact Analysis

If exploited, this flaw could cause system instability, crashes, or unexpected behavior due to corrupted memory access. Attackers might leverage it to escalate privileges, execute arbitrary code, or trigger denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability affects compliance with standards like GDPR and HIPAA by potentially enabling unauthorized access or data breaches due to improper user reference handling in the Linux kernel's IPMI subsystem. If exploited, it could lead to memory corruption or privilege escalation, compromising data integrity and confidentiality.

Mitigation Strategies

Update your Linux kernel to the patched version that resolves this issue. If immediate patching is not possible, disable the IPMI subsystem by unloading the ipmi modules: rmmod ipmi_devintf ipmi_si ipmi_msghandler. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-72042. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70