CVE-2026-72040ipmi: fix refcount leak in i_ipmi_request()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in i_ipmi_request() When a caller provides a `supplied_recv` message to i_ipmi_request(), the function increments the user's `nr_msgs` reference count. If an error occurs later, the out_err cleanup path only frees the recv_msg if the function allocated it itself (i.e., !supplied_recv). In the supplied_recv case the cleanup is skipped, leaving the reference count elevated. The caller ipmi_request_supply_msgs() does not release the supplied_recv on error, so the reference is permanently leaked. Fix this by explicitly reverting the reference count operations when a supplied recv_msg with a valid user pointer is present in the error path: decrement nr_msgs and drop the user's kref.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from f63723ca7d7623f9dae1990973cd158671f03c56 before 122ca6b2af714e114c9b872a48372ace31a9ab1f; 348121b29594d42d1635648fd3ed31dfa25351d5 builds before 9409e18ffe7378d202efe1cf69989df9f67b0369; from 53d6e403affbf6df2c859a0ea00ccfc1e72090ca before e2a3b77df6aef031455dd83ea8ed4344b7dca1f9; from b52da4054ee0bf9ecb44996f2c83236ff50b3812 before f5c5065963024390ddad51bd455d1adc710de575; from b52da4054ee0bf9ecb44996f2c83236ff50b3812 before 0fd23994ec8c5436d9f0b50848deb87ed933e6b3; from b52da4054ee0bf9ecb44996f2c83236ff50b3812 before a3f3859cecacb64f18fd446271ece9a3b3f2d4de; 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5; from 6.1.157 before 6.1.184; and 3 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/122ca6b2af714e114c9b872a48372ace31a9ab1f
- https://git.kernel.org/stable/c/9409e18ffe7378d202efe1cf69989df9f67b0369
- https://git.kernel.org/stable/c/e2a3b77df6aef031455dd83ea8ed4344b7dca1f9
- https://git.kernel.org/stable/c/f5c5065963024390ddad51bd455d1adc710de575
- https://git.kernel.org/stable/c/0fd23994ec8c5436d9f0b50848deb87ed933e6b3
- https://git.kernel.org/stable/c/a3f3859cecacb64f18fd446271ece9a3b3f2d4de
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.