Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-81007

ipmi: ipmb: validate write message length

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
None on Exploit-DB, Metasploit or GitHub

Summary

In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block write length. Require a non-empty buffer and the minimum IPMB request length. Also require the length byte plus payload before parsing the message.

Timeline

  1. CVE published
  2. Record last updated

Affected versions

  • Linux Linux

    From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in 8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in 94f8d20153e348c79bc14dc25f873470518892da; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in e527cd4e80066e1ed070fdc7c705bde340cdcc62; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in 7d66d54b974cff0a959e188af844d2d110422767; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in 60939bcda6f3f104ef456fdbf3cc5733c0720fb1; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in a84c6e3d188f2c6e674910929eb790634299d6d5; From 51bd6f291583684f495ea498984dfc22049d7fd2 · fixed in 53637506884dbd5c91a89b1a3547d99d80f8ed2c

  • Linux Linux

    5.3

  • KernelLinux

    From 5.3.0 · fixed in 5.10.270; From 5.11.0 · fixed in 5.15.221; From 5.16.0 · fixed in 6.1.188; From 6.2.0 · fixed in 6.6.157; From 6.7.0 · fixed in 6.12.109; From 6.13.0 · fixed in 6.18.50; From 6.19.0 · fixed in 7.2.4

References 8

git.kernel.org