CVE-2026-46044: Linux Kernel IPMI SSIF Kthread Cleanup Flaw

CVE-2026-46044 Overview

CVE-2026-46044 is a Linux kernel vulnerability in the Intelligent Platform Management Interface (IPMI) SSIF (SMBus System Interface) driver. The flaw resides in the kthread lifecycle management of the ipmi_ssif module. When an error occurs after the SSIF kthread is created but before the main IPMI code starts the SSIF interface, the kthread is not stopped. This leaves an orphaned kernel thread running after a failed initialization, leading to a resource leak inside the kernel.

Critical Impact
Failed initialization of the IPMI SSIF interface leaves an orphaned kernel thread, producing a kernel resource leak that may affect system stability on Linux hosts using IPMI over SMBus.

Affected Products

Linux kernel — drivers/char/ipmi/ipmi_ssif.c
Linux distributions shipping the IPMI SSIF driver prior to the upstream stable fix
Server platforms relying on IPMI baseboard management controller (BMC) access via SMBus

Discovery Timeline

2026-05-27 - CVE-2026-46044 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46044

Vulnerability Analysis

The vulnerability exists in the IPMI SSIF driver, which provides a transport layer for IPMI messages over the SMBus interface to a BMC. During driver initialization, the SSIF code creates a dedicated kernel thread (kthread) to handle message processing. The driver then continues with additional setup before the main IPMI subsystem starts the SSIF interface.

If an error occurs in the window between kthread creation and the IPMI core registering the interface, the existing error path does not call kthread_stop() on the running thread. The kthread continues to run despite the failed initialization, consuming kernel resources and leaving dangling references to structures that the error path may free. This is a kernel resource management defect classified under improper cleanup on failure paths.

Root Cause

The root cause is a missing cleanup step in the SSIF driver's error handling path. The driver creates a kthread early in the probe sequence but does not track whether the kthread is running when later initialization steps fail. The fix ensures the kthread is stopped on any error condition if it is currently running, restoring symmetry between kthread creation and teardown.

Attack Vector

This is a local kernel reliability defect rather than a remotely reachable bug. Triggering the condition requires the IPMI SSIF probe path to fail at a specific point during driver initialization. The vulnerability primarily affects system stability and kernel resource hygiene on hosts that load the ipmi_ssif module. No exploitation in the wild has been reported, and no public proof-of-concept exists.

The upstream fix is described in the resolved Linux kernel commits. See the kernel commit 75c486cb1bca, commit 800febc637d1, and commit 858bc8b9edb6 for the resolution.

Detection Methods for CVE-2026-46044

Indicators of Compromise

Kernel log entries from the ipmi_ssif driver reporting probe or initialization failures
Lingering kssif kernel threads visible in ps -ef after IPMI driver load failures
Repeated IPMI SSIF error messages in dmesg following BMC or SMBus communication faults

Detection Strategies

Audit running kernel versions against the patched stable trees referenced in the upstream commits
Inspect dmesg and journal logs for ipmi_ssif initialization errors followed by orphaned kthread activity
Track kernel module load and unload events for ipmi_ssif to identify hosts exposed to the defect

Monitoring Recommendations

Forward kernel logs to a centralized logging system and alert on ipmi_ssif probe failures
Monitor for unexpected kernel thread counts associated with IPMI on servers using SMBus-attached BMCs
Include kernel package versions in configuration management inventory to confirm patch deployment

How to Mitigate CVE-2026-46044

Immediate Actions Required

Apply the latest Linux kernel stable update that includes the IPMI SSIF kthread cleanup fix
Identify systems that load the ipmi_ssif module and prioritize them for patching
Validate that vendor kernels from Linux distributions have backported the upstream commits

Patch Information

The upstream fix ensures that the SSIF kthread is stopped on any error path if it is running. The change is contained in the kernel commits 75c486cb1bca, 800febc637d1, and 858bc8b9edb6. Administrators should update to a stable kernel release containing these commits and reboot affected hosts.

Workarounds

Unload the ipmi_ssif module on systems that do not require IPMI over SMBus until a patched kernel is deployed
Blocklist ipmi_ssif in /etc/modprobe.d/ on hosts where IPMI SSIF functionality is not in use
Where IPMI access is required, prefer alternate IPMI transports such as KCS or BT on platforms that support them until patching is complete

bash

# Configuration example: prevent ipmi_ssif from loading until kernel is patched
echo "blacklist ipmi_ssif" | sudo tee /etc/modprobe.d/blacklist-ipmi-ssif.conf
sudo modprobe -r ipmi_ssif 2>/dev/null || true
sudo update-initramfs -u