CVE-2026-81007: ipmi: ipmb: validate write message length
In the Linux kernel, the following vulnerability has been resolved:
ipmi: ipmb: validate write message length
ipmbwrite() read message fields before validating the length byte.
A zero or short write can read uninitialized stack bytes.
A length smaller than the SMBus header underflows the block write length.
Require a non-empty buffer and the minimum IPMB request length.
Also require the length byte plus payload before parsing the message.
Affected Software
Event History
Frequently Asked Questions
What access would an attacker need to trigger this issue?
They would need to submit writes to the IPMB write path and be able to provide malformed message data, such as a zero-length or otherwise short write.
What input validation can reduce exposure until the fix is deployed?
Reject empty buffers and requests shorter than the minimum IPMB request length. Also reject messages unless the declared length byte and the complete declared payload are present before parsing.