CVE-2026-81006: Linux Kernel IPMI Privilege Escalation Flaw

CVE-2026-81006 Overview

CVE-2026-81006 is a Linux kernel vulnerability in the Intelligent Platform Management Interface (IPMI) subsystem. The flaw exists in the ipmi_add_smi() function, which creates the nr_users and nr_msgs sysfs files before attempting to create the maintenance_mode file. When creation of maintenance_mode fails, the error path removes only nr_users before dropping the final reference to the interface. The nr_msgs sysfs attribute remains registered against a freed interface, leaving a dangling reference in kernel memory.

Critical Impact
A local attacker with low privileges can trigger a use-after-free condition in the IPMI subsystem, potentially leading to memory corruption, information disclosure, or local privilege escalation.

Affected Products

Linux kernel (IPMI subsystem)
Distributions shipping affected kernel versions prior to the referenced stable patches
Systems with IPMI drivers enabled and loaded

Discovery Timeline

2026-09-11 - CVE-2026-81006 published to the National Vulnerability Database (NVD)
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-81006

Vulnerability Analysis

The vulnerability resides in the IPMI System Management Interface (SMI) registration path within the Linux kernel. The ipmi_add_smi() function sequentially creates sysfs attributes for each IPMI interface it registers. It first creates the nr_users file, then the nr_msgs file, and finally attempts to create the maintenance_mode file.

If maintenance_mode creation fails, the cleanup path is incomplete. Only nr_users gets removed before the code drops the final reference to the interface, freeing the underlying memory. The nr_msgs attribute, however, remains registered in sysfs and still points into memory embedded within the freed interface structure.

Any subsequent access to the stale nr_msgs sysfs entry dereferences freed memory. This is a use-after-free condition classified under [CWE-416].

Root Cause

The root cause is incomplete error-handling in ipmi_add_smi(). The registration function does not unwind all previously created sysfs attributes when a later attribute creation fails. Because sysfs attributes are embedded inside the interface object, the mismatch between the object lifetime and the sysfs registration state creates a dangling kernel object.

Attack Vector

Exploitation requires local access with low privileges on a system where the IPMI driver is loaded and where the failure condition on maintenance_mode creation can be induced. An attacker able to trigger the error path and then interact with the residual nr_msgs sysfs entry can read from or write into freed kernel memory. Depending on heap state, this may enable kernel information disclosure or arbitrary write primitives leading to privilege escalation.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the upstream fixes in the Kernel Patch b115b7d06f, Kernel Patch b6c46ab0bd, and Kernel Patch d46c97eddc commits for the corrected error path.

Detection Methods for CVE-2026-81006

Indicators of Compromise

Kernel oops or panic messages referencing the IPMI subsystem, ipmi_add_smi, or nr_msgs sysfs entries
Unexpected module load or reload activity for ipmi_msghandler, ipmi_si, or related IPMI drivers on production systems
Slab corruption warnings or KASAN reports involving freed IPMI interface objects

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for warnings originating in drivers/char/ipmi/ around interface registration
Compare installed kernel versions against distribution advisories referencing the three stable patches to identify unpatched hosts
Track userspace processes accessing /sys/class/ipmi/ and /sys/devices/**/ipmi*/ attribute files with unusual frequency

Monitoring Recommendations

Enable audit rules for module loading events targeting the IPMI driver stack
Alert on repeated failures during device registration events in kernel logs
Correlate local privilege escalation indicators with IPMI subsystem activity on server hardware

How to Mitigate CVE-2026-81006

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as vendor-packaged updates are available
Inventory hosts with IPMI drivers loaded and prioritize patching on multi-tenant and bare-metal servers
Restrict local shell access on affected systems until the fixed kernel is deployed

Patch Information

The upstream fix extends the error path in ipmi_add_smi() to remove the nr_msgs sysfs attribute in addition to nr_users before dropping the final reference to the interface. The corrected cleanup ensures no sysfs attribute embedded in the freed interface remains registered. Fixes are available in the following stable commits: b115b7d06f, b6c46ab0bd, and d46c97eddc. Consume the fix through your distribution's kernel update channel.

Workarounds

Unload IPMI kernel modules (ipmi_si, ipmi_msghandler, ipmi_devintf) on systems that do not require baseboard management access
Blacklist IPMI modules in /etc/modprobe.d/ where hardware monitoring is not needed
Enforce least-privilege on local accounts and remove interactive shell access for service users on servers exposing IPMI interfaces

bash

# Disable IPMI kernel modules where not required
echo 'blacklist ipmi_si' | sudo tee /etc/modprobe.d/disable-ipmi.conf
echo 'blacklist ipmi_devintf' | sudo tee -a /etc/modprobe.d/disable-ipmi.conf
echo 'blacklist ipmi_msghandler' | sudo tee -a /etc/modprobe.d/disable-ipmi.conf
sudo rmmod ipmi_devintf ipmi_si ipmi_msghandler 2>/dev/null
sudo update-initramfs -u