CVE-2026-46128: Linux Kernel IPMI Buffer Vulnerability

CVE-2026-46128 Overview

CVE-2026-46128 affects the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. The vulnerability stems from the kernel performing the event message buffer response size validation too late in the processing flow. Certain Baseboard Management Controllers (BMCs) return an empty message instead of a proper error code when fetching events, leading to processing of malformed response data. Upstream maintainers resolved the issue by moving the response size check to immediately after the response arrives.

Critical Impact
The Linux kernel IPMI driver may process undersized BMC event responses, which can lead to undefined behavior when interacting with non-compliant BMC hardware.

Affected Products

Linux kernel IPMI subsystem (drivers/char/ipmi)
Distributions shipping the unpatched kernel with IPMI event message handler
Systems using BMCs that may return empty event responses

Discovery Timeline

2026-05-28 - CVE-2026-46128 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46128

Vulnerability Analysis

The Linux kernel IPMI driver communicates with BMC hardware to retrieve System Event Log (SEL) data and related platform events. The driver retrieves event messages from the BMC's event message buffer through standard IPMI command/response sequences. In the affected code paths, the response data size was validated later during processing rather than immediately after the response was received from the BMC.

Some newer BMCs deviate from expected IPMI behavior. Instead of returning a proper error code when no events are available or when an error condition occurs, these BMCs return an empty message. The kernel then propagated this malformed response further into the processing pipeline before catching the size mismatch. This delayed validation creates a window where the driver operates on response data that does not meet the minimum expected size.

Root Cause

The root cause is improper input validation [CWE-20] of inbound IPMI response payloads from the BMC. The IPMI driver assumed responses would either carry the expected event payload or signal a defined IPMI completion code error. Empty responses from non-compliant BMCs fell outside both assumptions, and the late check did not guard the intermediate processing steps that ran first.

Attack Vector

The condition is triggered by BMC firmware behavior rather than by network-reachable attackers. A BMC returning an empty response when the IPMI driver requests event message buffer contents will exercise the unvalidated code path. The vulnerability is bounded to local kernel-mode behavior on systems whose BMC exhibits the non-compliant response pattern.

No verified public proof-of-concept code is available. Refer to the upstream kernel commits for the exact code locations and patch logic: kernel commit 2418e4b, kernel commit 24269264, kernel commit 36920f3, kernel commit 42432b5, and kernel commit 7f7ada7.

Detection Methods for CVE-2026-46128

Indicators of Compromise

Kernel log entries from the ipmi subsystem reporting unexpected or short event message buffer responses.
Repeated IPMI event fetch failures correlated with BMC firmware models that return empty responses.
dmesg output showing IPMI driver warnings during routine SEL polling.

Detection Strategies

Inventory kernel versions across Linux hosts and compare against the fixed commits listed in the upstream stable trees.
Audit servers with IPMI/BMC hardware to identify BMC firmware revisions known to return empty event responses.
Monitor kernel ring buffer telemetry for IPMI subsystem anomalies tied to event message buffer handling.

Monitoring Recommendations

Forward dmesg and journald kernel logs to a centralized log platform and alert on IPMI driver warnings.
Track BMC firmware versions as part of standard configuration management to detect non-compliant models.
Include kernel package version data in vulnerability management scans so unpatched IPMI code paths are visible.

How to Mitigate CVE-2026-46128

Immediate Actions Required

Apply the latest stable kernel update from your Linux distribution that incorporates the upstream IPMI fix.
Identify systems running BMC firmware known to return empty IPMI event responses and prioritize patching those hosts.
Validate that the ipmi_msghandler and related modules are running the patched version after reboot.

Patch Information

The fix moves the event message buffer response size check to immediately after the response is received, rejecting empty or undersized responses before further processing. The patch is distributed across multiple stable kernel branches via the commits referenced above. Consult your distribution's security advisories for the specific kernel package versions containing these commits.

Workarounds

Update BMC firmware to a vendor release that returns proper IPMI completion codes instead of empty responses.
If IPMI event polling is not required, unload the ipmi_msghandler and ipmi_si modules to remove the affected code path from use.
Restrict access to BMC management interfaces to trusted administrative networks until the kernel patch is applied.

bash

# Verify running kernel version and IPMI module status
uname -r
lsmod | grep ipmi

# Optionally unload IPMI modules where event polling is not required
sudo modprobe -r ipmi_si
sudo modprobe -r ipmi_msghandler