CVE-2026-23322: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23322 Overview

A use-after-free and list corruption vulnerability has been discovered in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem. The flaw exists in the smi_work() function, where improper error handling when the SMI sender returns an error leads to memory corruption and potential system crashes. When the sender fails, the function delivers an error response but jumps back to restart without properly cleaning up, resulting in the same message being processed multiple times with corrupted list state.

Critical Impact
This vulnerability can lead to list corruption ("list_add double add"), use-after-free conditions, and NULL pointer dereferences, potentially causing kernel crashes, denial of service, or privilege escalation on affected Linux systems.

Affected Products

Linux kernel with IPMI subsystem enabled
Systems utilizing IPMI for out-of-band management
Server hardware with IPMI/BMC controllers

Discovery Timeline

2026-03-25 - CVE CVE-2026-23322 published to NVD
2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-23322

Vulnerability Analysis

The vulnerability resides in the IPMI subsystem's smi_work() function responsible for handling System Management Interface operations. When the SMI sender encounters an error condition, the function attempts to deliver an error response via deliver_err_response() but then executes a goto restart without properly cleaning up the internal state. This creates a dangerous race condition where:

The intf->curr_msg pointer is not cleared, preventing new messages from being pulled
The newmsg pointer continues to reference the already-processed message
The sender() function is called again with the same message that was already handled

When sender() fails again on the same message, deliver_err_response() is called a second time with the same recv_msg structure that was already queued for delivery. This results in list_add corruption as the same node is added to the user_msgs list twice. Subsequently, when this corrupted list is traversed and memory is freed, use-after-free conditions occur, eventually leading to a NULL pointer dereference when accessing recv_msg->done.

Root Cause

The root cause is inadequate error handling in the smi_work() function. When a send operation fails, the function does not properly clean up the current message state before restarting the work loop. Specifically, the curr_msg is not set to NULL and the newmsg is not freed, leaving dangling references that cause subsequent operations to corrupt kernel data structures. This is a classic resource cleanup failure that leads to double-add list corruption and use-after-free memory safety violations.

Attack Vector

The attack vector for this vulnerability involves triggering conditions that cause the SMI sender to fail repeatedly. An attacker with access to IPMI interfaces or the ability to induce hardware errors could potentially exploit this flaw. The buggy sequence occurs as follows:

The initial sender() call fails, triggering deliver_err_response(recv_msg) which queues the receive message for delivery. The function then executes goto restart without clearing curr_msg. On restart, since curr_msg is not cleared, no new message is pulled and the same newmsg pointer is used. When sender() fails again on the same message, deliver_err_response(recv_msg) attempts to queue the same recv_msg structure again, corrupting the linked list and leading to memory safety violations during subsequent list operations.

Detection Methods for CVE-2026-23322

Indicators of Compromise

Kernel panic messages containing "list_add double add" corruption warnings
Kernel oops or crashes related to IPMI subsystem components (ipmi_msghandler, ipmi_si)
NULL pointer dereference errors in kernel logs referencing recv_msg->done
System instability during heavy IPMI operations or management traffic

Detection Strategies

Monitor kernel logs (dmesg, /var/log/kern.log) for list corruption or use-after-free messages
Implement kernel crash dump analysis to detect memory corruption patterns in IPMI structures
Deploy kernel live patching detection to identify unpatched systems
Use kernel address sanitizer (KASAN) in development environments to catch use-after-free conditions

Monitoring Recommendations

Enable kernel crash reporting and log aggregation for affected systems
Monitor IPMI-related system calls and driver activity for anomalies
Implement automated kernel version tracking to identify vulnerable systems
Configure alerts for unexpected IPMI subsystem errors or repeated sender failures

How to Mitigate CVE-2026-23322

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix
Review systems using IPMI for out-of-band management for exposure
Restrict IPMI interface access to trusted management networks only
Monitor affected systems for kernel crashes until patches are applied

Patch Information

The vulnerability has been addressed in the Linux kernel with commits that fix the improper cleanup in smi_work(). The fix ensures that the message is freed and set to NULL on send errors, preventing the double-add list corruption. Additionally, newmsg is now always freed on send errors to prevent memory leaks.

Available kernel patches:

Workarounds

Disable IPMI subsystem if not required for system management operations
Limit IPMI interface exposure through network segmentation and firewall rules
Monitor IPMI-related kernel modules and consider unloading ipmi_si if not in active use
Implement rate limiting on IPMI operations to reduce likelihood of triggering the race condition

bash

# Configuration example
# Disable IPMI modules if not required
sudo modprobe -r ipmi_si
sudo modprobe -r ipmi_devintf
sudo modprobe -r ipmi_msghandler

# Blacklist IPMI modules to prevent auto-loading
echo "blacklist ipmi_si" | sudo tee /etc/modprobe.d/blacklist-ipmi.conf
echo "blacklist ipmi_devintf" | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
echo "blacklist ipmi_msghandler" | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf