CVE-2026-81006 Overview
CVE-2026-81006 is a Linux kernel vulnerability in the Intelligent Platform Management Interface (IPMI) subsystem. The flaw exists in the ipmi_add_smi() function, which creates the nr_users and nr_msgs sysfs files before attempting to create the maintenance_mode file. When creation of maintenance_mode fails, the error path removes only nr_users before dropping the final reference to the interface. The nr_msgs sysfs attribute remains registered against a freed interface, leaving a dangling reference in kernel memory.
Critical Impact
A local attacker with low privileges can trigger a use-after-free condition in the IPMI subsystem, potentially leading to memory corruption, information disclosure, or local privilege escalation.
Affected Products
- Linux kernel (IPMI subsystem)
- Distributions shipping affected kernel versions prior to the referenced stable patches
- Systems with IPMI drivers enabled and loaded
Discovery Timeline
- 2026-09-11 - CVE-2026-81006 published to the National Vulnerability Database (NVD)
- 2026-09-13 - Last updated in NVD database
Technical Details for CVE-2026-81006
Vulnerability Analysis
The vulnerability resides in the IPMI System Management Interface (SMI) registration path within the Linux kernel. The ipmi_add_smi() function sequentially creates sysfs attributes for each IPMI interface it registers. It first creates the nr_users file, then the nr_msgs file, and finally attempts to create the maintenance_mode file.
If maintenance_mode creation fails, the cleanup path is incomplete. Only nr_users gets removed before the code drops the final reference to the interface, freeing the underlying memory. The nr_msgs attribute, however, remains registered in sysfs and still points into memory embedded within the freed interface structure.
Any subsequent access to the stale nr_msgs sysfs entry dereferences freed memory. This is a use-after-free condition classified under [CWE-416].
Root Cause
The root cause is incomplete error-handling in ipmi_add_smi(). The registration function does not unwind all previously created sysfs attributes when a later attribute creation fails. Because sysfs attributes are embedded inside the interface object, the mismatch between the object lifetime and the sysfs registration state creates a dangling kernel object.
Attack Vector
Exploitation requires local access with low privileges on a system where the IPMI driver is loaded and where the failure condition on maintenance_mode creation can be induced. An attacker able to trigger the error path and then interact with the residual nr_msgs sysfs entry can read from or write into freed kernel memory. Depending on heap state, this may enable kernel information disclosure or arbitrary write primitives leading to privilege escalation.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes in the Kernel Patch b115b7d06f, Kernel Patch b6c46ab0bd, and Kernel Patch d46c97eddc commits for the corrected error path.
Detection Methods for CVE-2026-81006
Indicators of Compromise
- Kernel oops or panic messages referencing the IPMI subsystem, ipmi_add_smi, or nr_msgs sysfs entries
- Unexpected module load or reload activity for ipmi_msghandler, ipmi_si, or related IPMI drivers on production systems
- Slab corruption warnings or KASAN reports involving freed IPMI interface objects
Detection Strategies
- Monitor kernel logs (dmesg, journalctl -k) for warnings originating in drivers/char/ipmi/ around interface registration
- Compare installed kernel versions against distribution advisories referencing the three stable patches to identify unpatched hosts
- Track userspace processes accessing /sys/class/ipmi/ and /sys/devices/**/ipmi*/ attribute files with unusual frequency
Monitoring Recommendations
- Enable audit rules for module loading events targeting the IPMI driver stack
- Alert on repeated failures during device registration events in kernel logs
- Correlate local privilege escalation indicators with IPMI subsystem activity on server hardware
How to Mitigate CVE-2026-81006
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor-packaged updates are available
- Inventory hosts with IPMI drivers loaded and prioritize patching on multi-tenant and bare-metal servers
- Restrict local shell access on affected systems until the fixed kernel is deployed
Patch Information
The upstream fix extends the error path in ipmi_add_smi() to remove the nr_msgs sysfs attribute in addition to nr_users before dropping the final reference to the interface. The corrected cleanup ensures no sysfs attribute embedded in the freed interface remains registered. Fixes are available in the following stable commits: b115b7d06f, b6c46ab0bd, and d46c97eddc. Consume the fix through your distribution's kernel update channel.
Workarounds
- Unload IPMI kernel modules (ipmi_si, ipmi_msghandler, ipmi_devintf) on systems that do not require baseboard management access
- Blacklist IPMI modules in /etc/modprobe.d/ where hardware monitoring is not needed
- Enforce least-privilege on local accounts and remove interactive shell access for service users on servers exposing IPMI interfaces
# Disable IPMI kernel modules where not required
echo 'blacklist ipmi_si' | sudo tee /etc/modprobe.d/disable-ipmi.conf
echo 'blacklist ipmi_devintf' | sudo tee -a /etc/modprobe.d/disable-ipmi.conf
echo 'blacklist ipmi_msghandler' | sudo tee -a /etc/modprobe.d/disable-ipmi.conf
sudo rmmod ipmi_devintf ipmi_si ipmi_msghandler 2>/dev/null
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
