ALSA-2026:89754: Moderate: freeipmi security, bug fix, and enhancement update

Q: What types of impact are addressed by this update?

The update addresses multiple arbitrary code execution issues, including stack-based buffer overflows and malformed Fujitsu System Event Log responses. It also addresses a denial-of-service issue caused by a stack-based buffer over-read in ipmi-oem.

Q: Are any of the affected code paths tied to specific hardware vendors?

Yes. One issue involves malformed Fujitsu System Event Log responses, and another affects the Dell system information handler in ipmi-oem. The advisory also lists several overflow issues without identifying a vendor-specific handler.

Q: What update is identified as fixing the buffer-overflow issues?

The advisory states that freeipmi was updated to version 1.6.20 to fix two potential buffer overflows for almalinux-8.10.z.

Published Oct 26, 2026

Updated

The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses (CVE-2026-85504) FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85507) FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem (CVE-2026-85506) FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow (CVE-2026-85509) FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem (CVE-2026-85505) freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler (CVE-2026-85508)

Bug Fix(es) and Enhancement(s):

Update freeipmi to 1.6.20 to fix two potential buffer overflows [almalinux-8.10.z] (JIRA:AlmaLinux-279519)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

5 affected componentsFixes available

almalinux/freeipmi<1.6.20-1.el8_10

1.6.20-1.el8_10

almalinux/freeipmi-bmc-watchdog<1.6.20-1.el8_10

1.6.20-1.el8_10

almalinux/freeipmi-devel<1.6.20-1.el8_10

1.6.20-1.el8_10

almalinux/freeipmi-ipmidetectd<1.6.20-1.el8_10

1.6.20-1.el8_10

almalinux/freeipmi-ipmiseld<1.6.20-1.el8_10

1.6.20-1.el8_10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/freeipmi to a version that resolves this vulnerability.
Fixed in 1.6.20-1.el8_10
Upgrade
Upgrade almalinux/freeipmi-bmc-watchdog to a version that resolves this vulnerability.
Fixed in 1.6.20-1.el8_10
Upgrade
Upgrade almalinux/freeipmi-devel to a version that resolves this vulnerability.
Fixed in 1.6.20-1.el8_10
Upgrade
Upgrade almalinux/freeipmi-ipmidetectd to a version that resolves this vulnerability.
Fixed in 1.6.20-1.el8_10
Upgrade
Upgrade almalinux/freeipmi-ipmiseld to a version that resolves this vulnerability.
Fixed in 1.6.20-1.el8_10
Upgrade
Upgrade freeipmi to a version that resolves this vulnerability.
Fixed in 1.6.20

Event History

Oct 26, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

What types of impact are addressed by this update?

The update addresses multiple arbitrary code execution issues, including stack-based buffer overflows and malformed Fujitsu System Event Log responses. It also addresses a denial-of-service issue caused by a stack-based buffer over-read in ipmi-oem.

Are any of the affected code paths tied to specific hardware vendors?

Yes. One issue involves malformed Fujitsu System Event Log responses, and another affects the Dell system information handler in ipmi-oem. The advisory also lists several overflow issues without identifying a vendor-specific handler.

What update is identified as fixing the buffer-overflow issues?

The advisory states that freeipmi was updated to version 1.6.20 to fix two potential buffer overflows for almalinux-8.10.z.

ALSA-2026:89754: Moderate: freeipmi security, bug fix, and enhancement update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What types of impact are addressed by this update?

Are any of the affected code paths tied to specific hardware vendors?

What update is identified as fixing the buffer-overflow issues?

Company

Resources

Contact

Frequently Asked Questions

What types of impact are addressed by this update?

Are any of the affected code paths tied to specific hardware vendors?

What update is identified as fixing the buffer-overflow issues?