CVE-2026-81005 Overview
CVE-2026-81005 is a NULL pointer dereference vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem, specifically in the ipmi_si driver. The flaw resides in the failed-registration rollback path of try_smi_init() and ipmi_add_smi(). When the Baseboard Management Controller (BMC) fails to respond to a Get Device ID command, the lower driver's shutdown callback frees smi_info->si_sm without setting intf->in_shutdown. This allows the asynchronous redo_bmc_reg work item to dereference a NULL pointer inside start_kcs_transaction(), triggering a kernel crash.
Critical Impact
Local kernel crash (denial of service) triggered on systems where IPMI SI interface registration fails during boot or driver load.
Affected Products
- Linux kernel ipmi_si driver (multiple stable branches)
- Systems using IPMI hardware with KCS (Keyboard Controller Style) interfaces
- Server platforms exposing BMC device IDs via IPMI
Discovery Timeline
- 2026-09-11 - CVE-2026-81005 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-81005
Vulnerability Analysis
The vulnerability originates in the IPMI system interface (ipmi_si) driver registration path. try_smi_init() allocates new_smi->si_sm and then calls ipmi_register_smi_mod(), which maps to ipmi_add_smi(). During registration, the upper IPMI message handler calls __bmc_get_device_id() to obtain initial BMC device information.
If the BMC returns a nonzero completion code, the helper retries the command and eventually returns -EIO. On this failure, ipmi_add_smi() jumps to the out_err_started label, which invokes the lower driver's shutdown callback (shutdown_smi()). That callback tears down the SI state machine, frees smi_info->si_sm, and sets both smi_info->si_sm and smi_info->intf to NULL.
Root Cause
The rollback path does not set intf->in_shutdown before invoking the lower driver's shutdown callback. Because that flag remains clear, the asynchronous redo_bmc_reg work item, scheduled earlier by the message handler, continues to retry BMC device-ID probing after the SI state machine data has already been freed. The retry path reaches start_next_msg() and hands the NULL smi_info->si_sm pointer to the selected KCS state machine handler, triggering a NULL pointer dereference in start_kcs_transaction() [CWE-476].
Attack Vector
Exploitation requires a BMC that returns an unsuccessful response to the Get Device ID command during driver initialization. The condition is triggered by hardware or firmware behavior rather than remote input. An attacker with local privileges capable of loading or reloading the ipmi_si module against a misbehaving BMC could reproducibly crash the kernel. The observed crash occurs on the events workqueue executing redo_bmc_reg from ipmi_msghandler.
No synthetic exploitation code is provided. Refer to the upstream patches for the exact code paths corrected.
Detection Methods for CVE-2026-81005
Indicators of Compromise
- Kernel log entries: ipmi_si ...: IPMI message handler: Unable to get the device id: -5
- Kernel log entries: ipmi_si ...: Unable to register device: error -5
- Kernel oops referencing start_kcs_transaction+0x2c/0x190 [ipmi_si] with redo_bmc_reg in the call trace
- Unexpected reboots or kernel panics on servers immediately following IPMI driver load
Detection Strategies
- Monitor dmesg and /var/log/messages for the IPMI registration failure sequence followed by workqueue crashes.
- Correlate BMC health telemetry with kernel warnings related to ipmi_msghandler and ipmi_si.
- Track running kernel versions across the fleet against the fixed stable commits listed in the upstream references.
Monitoring Recommendations
- Ingest kernel logs into a centralized logging pipeline and alert on Unable to register device combined with NULL pointer dereference.
- Track systems where ipmi_si module load produces -EIO return codes to identify BMC firmware regressions.
- Include IPMI subsystem crash signatures in host availability and reliability dashboards.
How to Mitigate CVE-2026-81005
Immediate Actions Required
- Apply the upstream kernel patches for your stable branch as listed in the references.
- Identify hosts with BMCs returning nonzero completion codes for Get Device ID and update BMC firmware where available.
- If patching is delayed, avoid unloading and reloading ipmi_si on affected systems.
Patch Information
The fix sets intf->in_shutdown on the out_err_started path before invoking the lower driver's shutdown callback. This prevents redo_bmc_reg from using an interface whose lower driver state has been cleaned up. Backports are available in the following commits: Kernel Patch Commit 53af3a8, Kernel Patch Commit 6d920a7, Kernel Patch Commit 75ecc80, Kernel Patch Commit 8ada17d, Kernel Patch Commit b11a1e5, Kernel Patch Commit d377bf7, Kernel Patch Commit d4be659, and Kernel Patch Commit f390b0e.
Workarounds
- Blacklist the ipmi_si module on systems that do not require IPMI functionality until a patched kernel is deployed.
- Restrict local privileged access to prevent untrusted users from reloading kernel modules.
- Coordinate with hardware vendors to remediate BMC firmware that fails Get Device ID commands.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
