CVE-2026-81007

Summary

In the Linux kernel, the following vulnerability has been resolved:

ipmi: ipmb: validate write message length

ipmb_write() read message fields before validating the length byte.

A zero or short write can read uninitialized stack bytes.

A length smaller than the SMBus header underflows the block write length.

Require a non-empty buffer and the minimum IPMB request length.

Also require the length byte plus payload before parsing the message.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux51bd6f291583684f495ea498984dfc22049d7fd2 < 60939bcda6f3f104ef456fdbf3cc5733c0720fb1affected
LinuxLinux51bd6f291583684f495ea498984dfc22049d7fd2 < 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0affected
LinuxLinux51bd6f291583684f495ea498984dfc22049d7fd2 < a84c6e3d188f2c6e674910929eb790634299d6d5affected
LinuxLinux51bd6f291583684f495ea498984dfc22049d7fd2 < 53637506884dbd5c91a89b1a3547d99d80f8ed2caffected
LinuxLinux5.3affected
LinuxLinux0 < 5.3unaffected
LinuxLinux6.12.109 <= 6.12.*unaffected
LinuxLinux6.18.50 <= 6.18.*unaffected
LinuxLinux7.2.4 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References