CVE-2026-72042: ipmi: Fix user refcount underflow in event delivery
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Fix user refcount underflow in event delivery
ipmiallocrecvmsg(user) takes the temporary user reference owned by the receive message, and ipmifreerecvmsg() drops it again. If event delivery fails after allocating receive messages for earlier users, handlereadeventrsp() rolls those messages back with ipmifreerecvmsg().
That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcountt's addition-on-zero warning when ipmiallocrecvmsg() tries to acquire another reference.
Remove the stale explicit put and the now-dead user assignment. Keep the listdel() and ipmifreerecvmsg() calls; they are the required rollback operations.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72042?
CVE-2026-72042 has a risk rating of 47, indicating a moderate level of severity.
How do I fix CVE-2026-72042?
To fix CVE-2026-72042, update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-72042?
CVE-2026-72042 affects Linux kernel versions prior to the fix release on August 15, 2026.
What are the potential impacts of CVE-2026-72042?
The potential impacts of CVE-2026-72042 include denial of service or unauthorized access due to the user refcount underflow in event delivery.
Who is responsible for disclosing CVE-2026-72042?
CVE-2026-72042 was disclosed by contributors to the Linux kernel development community.