CVE-2026-89486: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89486 Overview

CVE-2026-89486 is a use-after-free vulnerability in the Linux kernel's Intelligent Platform Management Interface (IPMI) message handler. The flaw resides in _ipmi_destroy_user(), where command receivers on the intf->cmd_rcvrs list can be freed while concurrent readers still hold pointers to them. A previous commit removed the synchronize_rcu() barrier between unlinking receivers and freeing them, breaking the RCU grace-period contract that find_cmd_rcvr() and handle_ipmb_get_msg_cmd() rely on. Local authenticated attackers with access to IPMI interfaces can trigger the race to corrupt kernel memory. Successful exploitation can lead to kernel memory corruption, denial of service, or local privilege escalation.

Critical Impact
Local attackers with IPMI access can trigger a kernel use-after-free, potentially leading to privilege escalation or system compromise.

Affected Products

Linux kernel versions containing commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list")
Linux distributions shipping the affected upstream kernel with the IPMI message handler enabled
Systems using the ipmi_msghandler module for Baseboard Management Controller (BMC) communication

Discovery Timeline

2026-09-11 - CVE-2026-89486 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-89486

Vulnerability Analysis

The vulnerability affects the IPMI message handler subsystem in the Linux kernel. IPMI provides an interface between the operating system and platform management hardware such as BMCs. The kernel maintains a list of command receivers (cmd_rcvrs) that route incoming IPMI messages to registered user contexts.

Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") removed the synchronize_rcu() call between unlinking receivers from intf->cmd_rcvrs and freeing them. Only the comment explaining the barrier was updated; the actual synchronization primitive was dropped. The rework was intended to eliminate SRCU only for the ipmi_interfaces list, but it inadvertently removed the grace period required by the separate cmd_rcvrs list.

Root Cause

The cmd_rcvrs list continues to be traversed under plain RCU. find_cmd_rcvr() walks the list inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side critical section. Without a preceding synchronize_rcu(), _ipmi_destroy_user() can call kfree() on a cmd_rcvr object while a concurrent reader still holds a live pointer to it. The result is a classic use-after-free [CWE-416] on kernel heap memory.

Attack Vector

Exploitation requires local access with sufficient privileges to open and interact with the IPMI character device (typically /dev/ipmi0 or /dev/ipmi/0). An attacker races the destruction of an IPMI user context against inbound IPMB command delivery. Winning the race causes a reader thread to dereference a freed cmd_rcvr structure. Skilled attackers can shape the kernel heap to place attacker-controlled data at the freed location, converting the use-after-free into arbitrary read, write, or control-flow hijack primitives.

No verified public exploit code is available. See the upstream fix commit for technical details on the corrected synchronization sequence.

Detection Methods for CVE-2026-89486

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ipmi_msghandler, find_cmd_rcvr, handle_ipmb_get_msg_cmd, or _ipmi_destroy_user
KASAN reports flagging use-after-free reads or writes in the IPMI subsystem
Unexplained process crashes or privilege changes on hosts with active IPMI workloads

Detection Strategies

Enable KASAN on test kernels to surface use-after-free conditions during IPMI stress testing
Audit which non-root users and services have read/write access to /dev/ipmi* device nodes
Correlate kernel ring-buffer messages with process activity opening IPMI file descriptors

Monitoring Recommendations

Collect dmesg and /var/log/kern.log centrally and alert on RCU-related warnings or IPMI stack traces
Track loaded kernel modules and flag unexpected loads of ipmi_msghandler or ipmi_devintf on hosts that do not require them
Monitor auditd for open() and ioctl() calls against IPMI device files from non-management processes

How to Mitigate CVE-2026-89486

Immediate Actions Required

Apply the upstream Linux kernel patches that restore the synchronize_rcu() call before freeing command receivers
Restrict access to /dev/ipmi* device nodes to trusted administrative accounts and management daemons only
Unload the ipmi_msghandler and related modules on hosts that do not require in-band IPMI access

Patch Information

The fix restores the synchronize_rcu() grace period in _ipmi_destroy_user() between unlinking cmd_rcvr entries and calling kfree() on them. Patches are available in the upstream Linux stable tree via the following commits: 05ec76cfbce6, 3088e41292fe, and 5dc0b2a9af95. Rebuild and deploy the patched kernel, then reboot affected hosts.

Workarounds

Blacklist the ipmi_msghandler, ipmi_devintf, and ipmi_si modules on systems that do not need in-band IPMI functionality
Tighten permissions on /dev/ipmi* to root-only access using udev rules until patches can be deployed
Isolate hosts that require IPMI access on management VLANs and limit local shell access to trusted operators

bash

# Blacklist IPMI modules until the kernel is patched
echo 'blacklist ipmi_msghandler' | sudo tee /etc/modprobe.d/blacklist-ipmi.conf
echo 'blacklist ipmi_devintf'    | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
echo 'blacklist ipmi_si'        | sudo tee -a /etc/modprobe.d/blacklist-ipmi.conf
sudo update-initramfs -u

# Restrict device node permissions via udev
echo 'KERNEL=="ipmi*", MODE="0600", OWNER="root", GROUP="root"' \
  | sudo tee /etc/udev/rules.d/99-ipmi-restrict.rules
sudo udevadm control --reload-rules && sudo udevadm trigger