CVE-2026-46108: Linux Kernel IPMI DoS Vulnerability

CVE-2026-46108 Overview

CVE-2026-46108 is a Linux kernel vulnerability in the Intelligent Platform Management Interface (IPMI) System Interface (ipmi:si) driver. The flaw stems from improper state handling when a message allocation fails. In several code paths, the driver fails to return to its normal state if kmalloc-style message allocation does not succeed, leaving the driver in an inconsistent operational state. The upstream Linux kernel maintainers have resolved the issue across multiple stable branches.

Critical Impact
A failed message allocation can leave the IPMI System Interface driver stuck in a non-normal state, potentially disrupting baseboard management controller (BMC) communication on affected Linux systems.

Affected Products

Linux kernel ipmi:si (IPMI System Interface) driver
Stable kernel branches receiving the backported fix commits
Server-class Linux systems using IPMI for BMC communication

Discovery Timeline

2026-05-28 - CVE-2026-46108 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46108

Vulnerability Analysis

The vulnerability resides in the IPMI System Interface driver, which handles low-level communication between the kernel and a system's baseboard management controller. The driver maintains an internal state machine that tracks whether a message transaction is in progress or idle. When the driver attempts to allocate a new message structure and the allocation fails, several code paths previously did not reset the state machine to its normal idle state. This left the driver believing a transaction was active when no work had actually been initiated.

Root Cause

The root cause is missing error-path state cleanup [CWE-755 class]. Multiple call sites within the ipmi:si driver invoked message allocation routines and returned early on failure without restoring the driver state. Because no follow-on message processing occurred, the state machine never advanced and subsequent operations could stall or behave inconsistently. The fix ensures the driver explicitly returns to the normal state whenever allocation failures abort message initiation.

Attack Vector

The issue is triggered under memory pressure conditions where kernel allocations fail. It is not described as a remotely exploitable condition. The practical impact is a denial-of-service style stall in IPMI communication rather than memory corruption or code execution. Systems experiencing low-memory events on hosts that rely on IPMI for out-of-band management are most likely to encounter the bug.

No verified proof-of-concept code is published. Technical details are available in the upstream commits, including Kernel Git Commit 09dd798, Kernel Git Commit 88881dc, Kernel Git Commit ba60140, Kernel Git Commit bc13fce, and Kernel Git Commit ce905b6.

Detection Methods for CVE-2026-46108

Indicators of Compromise

Stalled or unresponsive IPMI transactions observed through ipmitool or BMC management agents.
Kernel log entries from the ipmi_si driver indicating allocation failures or stuck message processing.
System memory pressure events (oom_kill, allocation failure warnings) correlated with loss of IPMI responsiveness.

Detection Strategies

Monitor kernel ring buffer output (dmesg) for ipmi_si warnings, allocation failures, and unexpected state transitions.
Track running kernel versions across the fleet against the patched stable releases referenced in the upstream commits.
Correlate BMC health checks with host-side memory pressure metrics to identify suspicious stalls.

Monitoring Recommendations

Add alerting on IPMI command timeouts from monitoring tools that probe BMCs from the host operating system.
Capture kmalloc allocation failure counters from /proc/vmstat and node telemetry pipelines.
Establish a baseline for IPMI latency so degradations triggered by allocation failures are flagged quickly.

How to Mitigate CVE-2026-46108

Immediate Actions Required

Identify all Linux hosts running an IPMI-enabled kernel where the ipmi_si module is loaded.
Schedule kernel upgrades to a stable release containing the upstream fix commits referenced above.
Review memory pressure profiles on affected servers to reduce the likelihood of allocation failures triggering the bug.

Patch Information

The fix is committed to the upstream Linux kernel stable tree across multiple branches. Apply the vendor kernel update that incorporates the change introduced by commits 09dd798, 88881dc, ba60140, bc13fce, and ce905b6. Distribution-provided kernel packages should be installed once they include these backports.

Workarounds

Unload the ipmi_si module on systems that do not require in-band IPMI access until a patched kernel is deployed.
Increase available memory or tune workloads to reduce kernel allocation failures on affected hosts.
Rely on out-of-band BMC access paths for management while the host kernel remains unpatched.

bash

# Verify ipmi_si module status and current kernel version
uname -r
lsmod | grep ipmi_si

# Temporarily unload the IPMI System Interface driver (where in-band IPMI is not required)
sudo modprobe -r ipmi_si

# Prevent automatic loading until the kernel is patched
echo "blacklist ipmi_si" | sudo tee /etc/modprobe.d/blacklist-ipmi_si.conf