CVE-2026-81004: Linux Kernel IPMI Privilege Escalation

CVE-2026-81004 Overview

CVE-2026-81004 is a Linux kernel vulnerability in the Intelligent Platform Management Interface (IPMI) message handler subsystem. When an error occurs during IPMI interface startup, the driver may leave scheduled work pending. The interface can then be freed while that work is still queued, creating a use-after-free condition in kernel memory.

The issue was resolved with a fix that cancels pending work cleanly on error paths in ipmi_msghandler. The vulnerability requires local access but no privileges or user interaction, and can result in loss of confidentiality, integrity, and availability at the kernel level.

Critical Impact
A local attacker triggering an IPMI initialization error can cause kernel memory corruption, potentially leading to privilege escalation or a full system compromise.

Affected Products

Linux kernel versions prior to the fix commits 99692252b348, a496c51dd325, and ae84a2536577
Distributions shipping the affected ipmi_msghandler driver
Systems with IPMI/BMC hardware or IPMI kernel modules loaded

Discovery Timeline

2026-09-11 - CVE-2026-81004 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-81004

Vulnerability Analysis

The flaw resides in the Linux kernel's IPMI message handler (drivers/char/ipmi/ipmi_msghandler.c). During IPMI interface registration, the driver may schedule deferred work items to complete initialization tasks. If an error occurs later in the startup path, the driver historically proceeded to free the interface structure without ensuring that previously scheduled work had been canceled or completed.

When the kernel work queue eventually dispatches the pending work item, it dereferences the freed interface structure. This produces a use-after-free condition [CWE-416] in a kernel context, which can be leveraged to corrupt kernel memory or hijack control flow. The attack executes locally with no authentication, and the kernel scope means successful exploitation impacts the entire host.

Root Cause

The root cause is missing cleanup of asynchronous work on an error path. The IPMI startup routine schedules work through the kernel work queue but does not invoke cancel_work_sync() before releasing the interface. Freeing a resource that a queued callback still references violates the ownership contract between the scheduler and the driver, creating a classic use-after-free.

Attack Vector

Exploitation requires a local attacker who can influence IPMI interface initialization to fail after work has been scheduled. This may be reachable through module loading, driver rebinding via sysfs, or interaction with the underlying Baseboard Management Controller (BMC) that triggers the error condition. Once the freed memory is reallocated with attacker-controlled contents, the deferred work callback operates on that memory, enabling kernel-level code execution or data corruption.

No public proof-of-concept is available and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The current EPSS probability is 0.18%.

Refer to the upstream patches for the code-level fix: Kernel Git Commit Fix, Kernel Git Commit Update, and Kernel Git Commit Change.

Detection Methods for CVE-2026-81004

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ipmi_msghandler, ipmi_msg_handler, or IPMI work queue functions in dmesg output.
KASAN reports indicating use-after-free within the IPMI subsystem during driver load or unload.
Repeated failures during IPMI interface registration followed by later kernel instability.

Detection Strategies

Monitor kernel logs for IPMI initialization errors followed by callback executions on the same interface identifier.
Compare running kernel versions against distribution advisories to identify hosts missing the ipmi_msghandler cancel-work fix.
Audit systems where the ipmi_msghandler, ipmi_si, or ipmi_ssif modules are loaded but the underlying hardware repeatedly reports errors.

Monitoring Recommendations

Ingest dmesg and journald kernel facility logs into a centralized log platform for correlation of IPMI errors with subsequent crashes.
Alert on any kernel BUG, WARN, or KASAN entry that references IPMI symbols on production servers.
Track module load and unload events for IPMI drivers using auditd rules on kernel-sensitive hosts.

How to Mitigate CVE-2026-81004

Immediate Actions Required

Apply the latest stable Linux kernel update from your distribution vendor that includes commits 99692252b348, a496c51dd325, and ae84a2536577.
Restrict local shell and module-loading privileges to trusted administrators on servers exposing IPMI interfaces.
Inventory servers with IPMI hardware and prioritize patching for management, hypervisor, and multi-tenant hosts.

Patch Information

The upstream fix cancels scheduled work on the error path before freeing the IPMI interface. Apply the patches referenced in the kernel git tree: a496c51dd325, 99692252b348, and ae84a2536577. Rebuild affected kernels or install vendor-backported packages, then reboot to activate the patched kernel.

Workarounds

Blacklist the ipmi_msghandler, ipmi_si, ipmi_ssif, and ipmi_devintf modules on systems that do not require IPMI functionality.
Restrict access to /dev/ipmi* device nodes to root only and remove CAP_SYS_MODULE from unprivileged accounts.
Disable automatic loading of IPMI modules through udev rules until the patched kernel is deployed.

bash

# Configuration example: prevent IPMI module autoload until patched
echo 'blacklist ipmi_msghandler' | sudo tee /etc/modprobe.d/blacklist-ipmi.conf
echo 'blacklist ipmi_si'         | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
echo 'blacklist ipmi_ssif'      | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
echo 'blacklist ipmi_devintf'   | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
sudo update-initramfs -u