High 7.8Published Aug 15, 2026

CVE-2026-72042ipmi: Fix user refcount underflow in event delivery

Updated under an hour ago (2026-10-19 10:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix user refcount underflow in event delivery ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg(). That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference. Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b52da4054ee0bf9ecb44996f2c83236ff50b3812 before ddbb6e3dc9bb4743de686aa1598c31e745cee76b; from b52da4054ee0bf9ecb44996f2c83236ff50b3812 before 7be349d4fcc5e065295b83418a22d27a68afbdb6; from b52da4054ee0bf9ecb44996f2c83236ff50b3812 before 6aa9e61c46465d231e9beddf56af7effd71be682; f63723ca7d7623f9dae1990973cd158671f03c56; 348121b29594d42d1635648fd3ed31dfa25351d5; 53d6e403affbf6df2c859a0ea00ccfc1e72090ca; 0ed73be9a2547ffb9b5c1d879ad9bfab73d920b5; from 6.1.157 before 6.2; and 3 more ranges	CNA record

References

https://git.kernel.org/stable/c/ddbb6e3dc9bb4743de686aa1598c31e745cee76b
https://git.kernel.org/stable/c/7be349d4fcc5e065295b83418a22d27a68afbdb6
https://git.kernel.org/stable/c/6aa9e61c46465d231e9beddf56af7effd71be682

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.