CVE-2026-81007

ipmi: ipmb: validate write message length

State: Published
Severity: 7.1 High
Published: Sep 11, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmi: ipmb: validate write message length

ipmb_write() read message fields before validating the length byte.

A zero or short write can read uninitialized stack bytes.

A length smaller than the SMBus header underflows the block write length.

Require a non-empty buffer and the minimum IPMB request length.

Also require the length byte plus payload before parsing the message.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	51bd6f291583684f495ea498984dfc22049d7fd2 to before 8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89Affected 51bd6f291583684f495ea498984dfc22049d7fd2 to before 94f8d20153e348c79bc14dc25f873470518892daAffected 51bd6f291583684f495ea498984dfc22049d7fd2 to before e527cd4e80066e1ed070fdc7c705bde340cdcc62Affected 51bd6f291583684f495ea498984dfc22049d7fd2 to before 7d66d54b974cff0a959e188af844d2d110422767Affected 51bd6f291583684f495ea498984dfc22049d7fd2 to before 60939bcda6f3f104ef456fdbf3cc5733c0720fb1Affected 51bd6f291583684f495ea498984dfc22049d7fd2 to before 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0Affected 51bd6f291583684f495ea498984dfc22049d7fd2 to before a84c6e3d188f2c6e674910929eb790634299d6d5Affected 51bd6f291583684f495ea498984dfc22049d7fd2 to before 53637506884dbd5c91a89b1a3547d99d80f8ed2cAffected
LinuxLinux	5.3Affected before 5.3Not affected 5.10.270 through 5.10.Not affected 5.15.221 through 5.15.Not affected 6.1.188 through 6.1.Not affected 6.6.157 through 6.6.Not affected 6.12.109 through 6.12.Not affected 6.18.50 through 6.18.Not affected 7.2.4 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

51bd6f291583684f495ea498984dfc22049d7fd2 to before 8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89Affected
51bd6f291583684f495ea498984dfc22049d7fd2 to before 94f8d20153e348c79bc14dc25f873470518892daAffected
51bd6f291583684f495ea498984dfc22049d7fd2 to before e527cd4e80066e1ed070fdc7c705bde340cdcc62Affected
51bd6f291583684f495ea498984dfc22049d7fd2 to before 7d66d54b974cff0a959e188af844d2d110422767Affected
51bd6f291583684f495ea498984dfc22049d7fd2 to before 60939bcda6f3f104ef456fdbf3cc5733c0720fb1Affected
51bd6f291583684f495ea498984dfc22049d7fd2 to before 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0Affected
51bd6f291583684f495ea498984dfc22049d7fd2 to before a84c6e3d188f2c6e674910929eb790634299d6d5Affected
51bd6f291583684f495ea498984dfc22049d7fd2 to before 53637506884dbd5c91a89b1a3547d99d80f8ed2cAffected

LinuxLinux

5.3Affected
before 5.3Not affected
5.10.270 through 5.10.*Not affected
5.15.221 through 5.15.*Not affected
6.1.188 through 6.1.*Not affected
6.6.157 through 6.6.*Not affected
6.12.109 through 6.12.*Not affected
6.18.50 through 6.18.*Not affected
7.2.4 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.