CVE-2026-89486

Received Received - Intake

Use-After-Free in Linux Kernel IPMI Subsystem

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() between unlinking the command receivers from intf->cmd_rcvrs and freeing them, updating only the comment that explains why the barrier is needed. The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr() walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a reader still holds a pointer to it, causing a use-after-free. The rework only made srcu unnecessary for the interfaces list; the cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu() before freeing the receivers.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89486

EUVD

EUVD-2026-76392

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's IPMI subsystem. It occurs when the cmd_rcvr structure is freed without proper synchronization, allowing a freed memory region to be accessed later by another part of the kernel. The issue stems from missing a synchronize_rcu() call before freeing cmd_rcvr objects, which are still referenced under RCU read-side critical sections.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPMI subsystem and requires kernel-level detection. Check kernel logs for use-after-free errors in IPMI-related modules using: dmesg | grep -i 'ipmi' or journalctl -k | grep -i 'ipmi'. If you suspect exploitation, monitor for crashes in ipmi-related processes or kernel panics.

Impact Analysis

This vulnerability could lead to kernel memory corruption, crashes, or privilege escalation. If exploited, it may allow an attacker to execute arbitrary code in the kernel context, potentially gaining full control over the system. Systems using IPMI features are most at risk.

Mitigation Strategies

Apply the latest kernel update from your distribution to patch the use-after-free issue. If immediate patching is not possible, disable the IPMI subsystem if unused by blacklisting the ipmi modules: echo 'blacklist ipmi_devintf' | sudo tee -a /etc/modprobe.d/disable-ipmi.conf and reboot.

Hi! I’m here to help you understand CVE-2026-89486. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70