CVE-2026-46177: Linux Kernel IPMI DoS Vulnerability

CVE-2026-46177 Overview

CVE-2026-46177 affects the Linux kernel's Intelligent Platform Management Interface (IPMI) driver. The driver fetches events and receive messages from a Baseboard Management Controller (BMC) without bounding the number of iterations. A misbehaving or buggy BMC that never signals completion can cause the driver to loop indefinitely. A related issue exists when the attn state bit returned by the System Interface (SI) hardware becomes stuck, blocking the driver inside flag-fetch logic. The upstream fix introduces a per-cycle limit of 10 fetches and interleaves message handling between flag fetches. The defect has existed since the driver's inception and accounts for firmware bugs in BMCs rather than a flaw in kernel logic itself.

Critical Impact
A faulty BMC can keep the IPMI driver looping on event or message fetches, preventing the driver from making progress and impacting host management reliability.

Affected Products

Linux kernel — IPMI subsystem (drivers/char/ipmi)
Systems using the IPMI System Interface (ipmi_si) driver with affected BMC firmware
Linux distributions shipping kernels prior to the stable backport commits

Discovery Timeline

2026-05-28 - CVE-2026-46177 published to the National Vulnerability Database
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46177

Vulnerability Analysis

The IPMI driver communicates with a BMC to retrieve asynchronous events and queued receive messages. The original driver design continued issuing fetch requests as long as the BMC advertised additional data. No upper bound existed on the number of consecutive fetches.

A BMC with broken firmware that perpetually reports "more data available" forces the driver into a tight servicing loop. While stuck, the driver cannot process other outstanding work, including normal command responses from user-space clients. The patch caps consecutive fetches at 10 per servicing cycle.

A secondary issue arises in the ipmi_si interface. Hardware reports an attn (attention) bit indicating the driver should fetch flags and decide whether to retrieve events or messages. If the attn bit becomes stuck high, the driver repeatedly enters flag-fetch logic without servicing pending messages. The fix permits message processing to interleave with flag fetches so forward progress is preserved.

Root Cause

The root cause is a missing iteration bound combined with strict ordering between flag fetches and message servicing. Both behaviors trusted the BMC to eventually signal completion. The driver did not defensively account for firmware that violates this contract, allowing buggy BMCs to monopolize the driver's state machine.

Attack Vector

No network attack vector is associated with this issue. Triggering requires a BMC whose firmware reports persistent data availability or whose attn state bit becomes stuck. Impact is limited to driver progress and host-side IPMI management functionality. The fix is defensive hardening against malfunctioning baseboard firmware. See the upstream patches referenced below for the exact code paths.

Refer to the upstream commits for implementation details: Linux Kernel Commit 3d37d21, Linux Kernel Commit 67c44e0, Linux Kernel Commit c024167, Linux Kernel Commit c4cca23, and Linux Kernel Commit e20212b.

Detection Methods for CVE-2026-46177

Indicators of Compromise

Kernel threads associated with ipmi_si or kipmid consuming high CPU for extended periods without corresponding user-space activity.
IPMI command timeouts reported by management agents while the driver remains busy fetching events or messages.
dmesg entries referencing repeated event or receive-message fetches against the BMC.

Detection Strategies

Audit kernel versions across managed Linux hosts and flag systems running kernels that predate the upstream fix commits.
Monitor CPU time consumed by IPMI worker threads and correlate with BMC firmware versions known to misreport data availability.
Track IPMI subsystem error counters and command latency through monitoring agents such as ipmitool or freeipmi.

Monitoring Recommendations

Collect kernel logs centrally and alert on sustained ipmi_si activity or repeated event-fetch messages.
Inventory BMC firmware versions and prioritize firmware updates on platforms with known IPMI misbehavior.
Baseline normal IPMI response times and alert on prolonged deviations indicating driver stalls.

How to Mitigate CVE-2026-46177

Immediate Actions Required

Identify hosts running Linux kernels without the IPMI fetch-limit patch and schedule kernel updates.
Apply BMC firmware updates from the hardware vendor to remediate underlying firmware bugs that trigger the condition.
Restrict access to IPMI management interfaces to administrative networks only.

Patch Information

The fix is delivered through five upstream commits in the stable Linux kernel tree. The patch adds a limit of 10 event or receive-message fetches per cycle and allows message handling between flag fetches in the ipmi_si interface. Reference commits: 3d37d21, 67c44e0, c024167, c4cca23, and e20212b. Apply distribution-provided kernel updates that include these backports.

Workarounds

Disable or unload the IPMI driver (modprobe -r ipmi_si ipmi_msghandler) on hosts where IPMI is not required for management.
Update BMC firmware to the latest vendor-supplied release to eliminate the originating misbehavior.
Where unloading is not feasible, monitor for driver stalls and reload the IPMI modules as a recovery action.

bash

# Configuration example
# Check loaded IPMI modules and current kernel version
uname -r
lsmod | grep ipmi

# Temporarily unload IPMI modules if not required
sudo modprobe -r ipmi_si
sudo modprobe -r ipmi_devintf
sudo modprobe -r ipmi_msghandler

# Prevent automatic loading at boot
echo "blacklist ipmi_si" | sudo tee /etc/modprobe.d/blacklist-ipmi.conf