High 7.8Published Sep 11, 2026

CVE-2026-89486ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()

Updated under an hour ago (2026-10-19 08:50 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user() Commit 9e91f8a6c868 ("ipmi:msghandler: Remove srcu for the ipmi_interfaces list") dropped the synchronize_rcu() between unlinking the command receivers from intf->cmd_rcvrs and freeing them, updating only the comment that explains why the barrier is needed. The cmd_rcvrs list is still traversed under plain RCU: find_cmd_rcvr() walks it inside rcu_read_lock(), and handle_ipmb_get_msg_cmd() borrows rcvr->user from that lookup within the same read-side section. Without the grace period, _ipmi_destroy_user() can kfree() a cmd_rcvr while a reader still holds a pointer to it, causing a use-after-free. The rework only made srcu unnecessary for the interfaces list; the cmd_rcvrs list still relies on plain RCU. Restore the synchronize_rcu() before freeing the receivers.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Sep 13, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 9e91f8a6c8688e27f4ccce7db457da87d6458836 before 3088e41292fecf132f85f79af5ee4d620b9ff1b4; 9e91f8a6c8688e27f4ccce7db457da87d6458836 builds before 5dc0b2a9af95a97861c1bffaf1687a3173e395c5; 9e91f8a6c8688e27f4ccce7db457da87d6458836 builds before 05ec76cfbce653e07cec19b9b8b20e33449d5d87	CNA record

References

https://git.kernel.org/stable/c/3088e41292fecf132f85f79af5ee4d620b9ff1b4
https://git.kernel.org/stable/c/5dc0b2a9af95a97861c1bffaf1687a3173e395c5
https://git.kernel.org/stable/c/05ec76cfbce653e07cec19b9b8b20e33449d5d87

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.