CVE-2026-72042

ipmi: Fix user refcount underflow in event delivery

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Aug 17, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix user refcount underflow in event delivery

ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg().

That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference.

Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b52da4054ee0bf9ecb44996f2c83236ff50b3812 to before ddbb6e3dc9bb4743de686aa1598c31e745cee76bAffected b52da4054ee0bf9ecb44996f2c83236ff50b3812 to before 7be349d4fcc5e065295b83418a22d27a68afbdb6Affected b52da4054ee0bf9ecb44996f2c83236ff50b3812 to before 6aa9e61c46465d231e9beddf56af7effd71be682Affected f63723ca7d7623f9dae1990973cd158671f03c56Affected 348121b29594d42d1635648fd3ed31dfa25351d5Affected 53d6e403affbf6df2c859a0ea00ccfc1e72090caAffected 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5Affected 6.1.157 to before 6.2Affected 6.6.113 to before 6.7Affected 6.12.54 to before 6.13Affected 6.17.4 to before 6.18Affected
LinuxLinux	6.18Affected before 6.18Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

b52da4054ee0bf9ecb44996f2c83236ff50b3812 to before ddbb6e3dc9bb4743de686aa1598c31e745cee76bAffected
b52da4054ee0bf9ecb44996f2c83236ff50b3812 to before 7be349d4fcc5e065295b83418a22d27a68afbdb6Affected
b52da4054ee0bf9ecb44996f2c83236ff50b3812 to before 6aa9e61c46465d231e9beddf56af7effd71be682Affected
f63723ca7d7623f9dae1990973cd158671f03c56Affected
348121b29594d42d1635648fd3ed31dfa25351d5Affected
53d6e403affbf6df2c859a0ea00ccfc1e72090caAffected
0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5Affected
6.1.157 to before 6.2Affected
6.6.113 to before 6.7Affected
6.12.54 to before 6.13Affected
6.17.4 to before 6.18Affected

LinuxLinux

6.18Affected
before 6.18Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.