UBUNTU-CVE-2026-81006: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ipmi: Remove all sysfs files on registration failure ipmiaddsmi() creates the nrusers and nrmsgs files before trying to create the maintenancemode file. If that last creation fails, the error path removes only nrusers before dropping the final reference to the interface. Remove nrmsgs as well so no sysfs attribute embedded in the freed interface remains registered.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In ipmi_add_smi()'s registration-failure error path, remove the nr_msgs sysfs file as well as nr_users before dropping the final reference to the interface, so no sysfs attribute embedded in the freed interface remains registered.
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What condition is required to reach the vulnerable path?
An IPMI interface registration must create nr_users and nr_msgs successfully, then fail while creating the maintenance_mode sysfs file. The incomplete cleanup leaves nr_msgs registered after the interface is freed.
What level of attacker access is indicated?
The provided vector indicates local access with low privileges and no user interaction. It also indicates high impact to confidentiality, integrity, and availability if exploited.