CVE-2026-89486: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix use-after-free of cmdrcvr in ipmidestroyuser()

Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmiinterfaces list") dropped the synchronizercu() between unlinking the command receivers from intf->cmdrcvrs and freeing them, updating only the comment that explains why the barrier is needed.

The cmdrcvrs list is still traversed under plain RCU: findcmdrcvr() walks it inside rcureadlock(), and handleipmbgetmsgcmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, ipmidestroyuser() can kfree() a cmdrcvr while a reader still holds a pointer to it, causing a use-after-free.

The rework only made srcu unnecessary for the interfaces list; the cmdrcvrs list still relies on plain RCU. Restore the synchronizercu() before freeing the receivers.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:43 PM
Data Sourced
via MITRE·07:43 PM
Description

Frequently Asked Questions

1

What conditions are required for this use-after-free to occur?

A command receiver must be removed while another execution path is concurrently traversing the interface command-receiver list under an RCU read-side critical section. The race occurs because the receiver can be freed without waiting for existing RCU readers to finish.

2

Which kernel component is involved in the vulnerable race?

The race is in the IPMI message handler's command-receiver list, intf->cmd_rcvrs. Readers include find_cmd_rcvr() and handle_ipmb_get_msg_cmd(), while _ipmi_destroy_user() removes and frees receivers.

3

What change addresses the issue?

The fix restores synchronize_rcu() after command receivers are unlinked and before they are freed. This ensures readers that may still hold a receiver pointer complete before its memory is released.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203