CVE-2026-43221: Linux Kernel IPMB Handler Vulnerability

CVE-2026-43221 Overview

CVE-2026-43221 is a Linux kernel vulnerability in the Intelligent Platform Management Bus (IPMB) driver inside the Intelligent Platform Management Interface (IPMI) subsystem. The IPMB event handler fails to initialise the byte count returned for I2C read operations. Although IPMB itself does not perform I2C reads, an I2C read against the bus driver returns an uninitialised value from kernel memory. The flaw is classified as an Uninitialized Memory Use issue [CWE-908] and was resolved upstream in the Linux kernel stable tree.

Critical Impact
Local processes interacting with the affected I2C bus can read uninitialised kernel stack or buffer contents, leading to potential information disclosure from kernel memory.

Affected Products

Linux kernel branches that include the ipmi-ipmb driver prior to the upstream fix
Linux distributions shipping vulnerable stable kernel trees referenced by the upstream commits
Systems using IPMB for Baseboard Management Controller (BMC) communication over I2C

Discovery Timeline

2026-05-06 - CVE-2026-43221 published to the National Vulnerability Database (NVD)
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43221

Vulnerability Analysis

The vulnerability exists in the IPMB transport driver for the Linux IPMI subsystem. IPMB rides on top of an I2C bus to communicate with a Baseboard Management Controller. The driver registers an event handler that responds to I2C operations. While IPMB only requires write semantics, the underlying I2C core can still issue read transactions against the registered slave device.

When such a read occurs, the IPMB handler does not populate the byte count or returned data. The I2C bus driver then propagates whatever value already resides at the return location. That value originates from uninitialised kernel memory and may include residual stack data or prior buffer contents. The fix initialises the read byte count inside the event handler so that the I2C layer always receives a defined value.

Root Cause

The root cause is missing initialisation in the IPMB I2C slave event handler. The handler treats I2C_SLAVE_READ_REQUESTED and related read events as out-of-scope for IPMB, but the I2C core contract requires the callback to set a return byte regardless. Failing to do so leaves the caller-supplied pointer pointing to uninitialised data.

Attack Vector

A local attacker with permission to interact with the I2C bus, or any kernel-side consumer that can trigger an I2C read against the IPMB slave, can observe leaked bytes from kernel memory. Exploitation requires local access to the relevant I2C device node or an in-kernel path that initiates a read on the bus. The vulnerability does not provide code execution, but the leaked bytes can aid in defeating Kernel Address Space Layout Randomisation (KASLR) or recovering sensitive in-memory data.

No verified public proof-of-concept code is associated with this CVE. The upstream fix can be reviewed in the Kernel Git Commit 1027124 and the parallel stable backports listed in the references.

Detection Methods for CVE-2026-43221

Indicators of Compromise

No file-based or network indicators are associated with this kernel-level information disclosure flaw.
Kernel version strings (uname -r) that predate the patched stable releases on systems with CONFIG_IPMI_IPMB enabled.
Presence of the ipmi_ipmb module loaded on hosts exposing I2C device nodes to non-root processes.

Detection Strategies

Inventory Linux hosts and compare running kernel versions against the fixed commits referenced by upstream stable trees.
Audit which user accounts and services hold access to /dev/i2c-* device nodes on systems where IPMB is in use.
Review kernel build configurations on BMC-adjacent hosts and management controllers for the presence of the ipmi-ipmb driver.

Monitoring Recommendations

Monitor loading of the ipmi_ipmb kernel module through audit subsystem rules on init_module and finit_module syscalls.
Track access patterns to I2C character devices and alert on unexpected processes opening /dev/i2c-* handles.
Centralise kernel version telemetry from all Linux endpoints and servers to confirm patch coverage after deployment.

How to Mitigate CVE-2026-43221

Immediate Actions Required

Upgrade affected Linux kernels to the stable release containing the IPMB initialisation fix referenced in the upstream commits.
Restrict access to /dev/i2c-* device nodes to root and trusted hardware management daemons only.
Unload the ipmi_ipmb module on systems that do not require IPMB transport for BMC communication.

Patch Information

The fix initialises the read byte count inside the IPMB I2C slave event handler. Distribution-supplied kernels should be updated once vendors backport the change. Reference commits include Kernel Git Commit 1027124, Kernel Git Commit 2dfbc8c, Kernel Git Commit 56d5c05, Kernel Git Commit 905554e, Kernel Git Commit 9f235cc, and Kernel Git Commit f726b3a.

Workarounds

Blacklist the ipmi_ipmb module on hosts that do not communicate with a BMC over IPMB.
Tighten Discretionary Access Control (DAC) on I2C device nodes so only privileged management agents can issue read transactions.
Disable the kernel build option CONFIG_IPMI_IPMB in custom kernels where IPMB transport is not required.

bash

# Configuration example: prevent the vulnerable module from loading
echo 'blacklist ipmi_ipmb' | sudo tee /etc/modprobe.d/ipmi-ipmb-blacklist.conf
sudo rmmod ipmi_ipmb 2>/dev/null || true
sudo update-initramfs -u