CVE-2026-23322 Overview
A use-after-free and list corruption vulnerability has been discovered in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem. The flaw exists in the smi_work() function, where improper error handling when the SMI sender returns an error leads to memory corruption and potential system crashes. When the sender fails, the function delivers an error response but jumps back to restart without properly cleaning up, resulting in the same message being processed multiple times with corrupted list state.
Critical Impact
This vulnerability can lead to list corruption ("list_add double add"), use-after-free conditions, and NULL pointer dereferences, potentially causing kernel crashes, denial of service, or privilege escalation on affected Linux systems.
Affected Products
- Linux kernel with IPMI subsystem enabled
- Systems utilizing IPMI for out-of-band management
- Server hardware with IPMI/BMC controllers
Discovery Timeline
- 2026-03-25 - CVE CVE-2026-23322 published to NVD
- 2026-03-25 - Last updated in NVD database
Technical Details for CVE-2026-23322
Vulnerability Analysis
The vulnerability resides in the IPMI subsystem's smi_work() function responsible for handling System Management Interface operations. When the SMI sender encounters an error condition, the function attempts to deliver an error response via deliver_err_response() but then executes a goto restart without properly cleaning up the internal state. This creates a dangerous race condition where:
- The intf->curr_msg pointer is not cleared, preventing new messages from being pulled
- The newmsg pointer continues to reference the already-processed message
- The sender() function is called again with the same message that was already handled
When sender() fails again on the same message, deliver_err_response() is called a second time with the same recv_msg structure that was already queued for delivery. This results in list_add corruption as the same node is added to the user_msgs list twice. Subsequently, when this corrupted list is traversed and memory is freed, use-after-free conditions occur, eventually leading to a NULL pointer dereference when accessing recv_msg->done.
Root Cause
The root cause is inadequate error handling in the smi_work() function. When a send operation fails, the function does not properly clean up the current message state before restarting the work loop. Specifically, the curr_msg is not set to NULL and the newmsg is not freed, leaving dangling references that cause subsequent operations to corrupt kernel data structures. This is a classic resource cleanup failure that leads to double-add list corruption and use-after-free memory safety violations.
Attack Vector
The attack vector for this vulnerability involves triggering conditions that cause the SMI sender to fail repeatedly. An attacker with access to IPMI interfaces or the ability to induce hardware errors could potentially exploit this flaw. The buggy sequence occurs as follows:
The initial sender() call fails, triggering deliver_err_response(recv_msg) which queues the receive message for delivery. The function then executes goto restart without clearing curr_msg. On restart, since curr_msg is not cleared, no new message is pulled and the same newmsg pointer is used. When sender() fails again on the same message, deliver_err_response(recv_msg) attempts to queue the same recv_msg structure again, corrupting the linked list and leading to memory safety violations during subsequent list operations.
Detection Methods for CVE-2026-23322
Indicators of Compromise
- Kernel panic messages containing "list_add double add" corruption warnings
- Kernel oops or crashes related to IPMI subsystem components (ipmi_msghandler, ipmi_si)
- NULL pointer dereference errors in kernel logs referencing recv_msg->done
- System instability during heavy IPMI operations or management traffic
Detection Strategies
- Monitor kernel logs (dmesg, /var/log/kern.log) for list corruption or use-after-free messages
- Implement kernel crash dump analysis to detect memory corruption patterns in IPMI structures
- Deploy kernel live patching detection to identify unpatched systems
- Use kernel address sanitizer (KASAN) in development environments to catch use-after-free conditions
Monitoring Recommendations
- Enable kernel crash reporting and log aggregation for affected systems
- Monitor IPMI-related system calls and driver activity for anomalies
- Implement automated kernel version tracking to identify vulnerable systems
- Configure alerts for unexpected IPMI subsystem errors or repeated sender failures
How to Mitigate CVE-2026-23322
Immediate Actions Required
- Update the Linux kernel to a patched version containing the fix
- Review systems using IPMI for out-of-band management for exposure
- Restrict IPMI interface access to trusted management networks only
- Monitor affected systems for kernel crashes until patches are applied
Patch Information
The vulnerability has been addressed in the Linux kernel with commits that fix the improper cleanup in smi_work(). The fix ensures that the message is freed and set to NULL on send errors, preventing the double-add list corruption. Additionally, newmsg is now always freed on send errors to prevent memory leaks.
Available kernel patches:
Workarounds
- Disable IPMI subsystem if not required for system management operations
- Limit IPMI interface exposure through network segmentation and firewall rules
- Monitor IPMI-related kernel modules and consider unloading ipmi_si if not in active use
- Implement rate limiting on IPMI operations to reduce likelihood of triggering the race condition
# Configuration example
# Disable IPMI modules if not required
sudo modprobe -r ipmi_si
sudo modprobe -r ipmi_devintf
sudo modprobe -r ipmi_msghandler
# Blacklist IPMI modules to prevent auto-loading
echo "blacklist ipmi_si" | sudo tee /etc/modprobe.d/blacklist-ipmi.conf
echo "blacklist ipmi_devintf" | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
echo "blacklist ipmi_msghandler" | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
