CVE-2026-72042 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Fix user refcount underflow in event delivery
ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg().
That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference.
Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
This vulnerability resides in the Linux kernel's IPMI subsystem where a race condition can occur during event delivery operations leading to potential system instability or privilege escalation. The flaw manifests when multiple users are involved in IPMI event handling, specifically when the system attempts to deliver events to registered users. The underlying issue stems from improper reference counting management within the IPMI message handling framework.
The technical root cause involves a user reference count underflow that occurs during error recovery paths in event delivery. When ipmi_alloc_recv_msg() is called to allocate receive messages for users, it takes temporary user references through the receive message structure. However, if subsequent event delivery operations fail after allocating messages for earlier users, the handle_read_event_rsp() function attempts to rollback these allocations using ipmi_free_recv_msg(). This rollback process contains a critical flaw where it explicitly drops the user reference count with an additional put operation after each message free, even though the standard cleanup already handles this reference management properly.
The operational impact of this vulnerability extends beyond simple memory corruption. When the extra put operation occurs on a user that has already been freed through normal cleanup processes, it can lead to dereferencing freed memory structures during subsequent event delivery attempts. This creates potential for system crashes, data corruption, or in worst-case scenarios, privilege escalation attacks where malicious actors could exploit the dangling pointer references to gain elevated system privileges. The vulnerability specifically affects systems running Linux kernels with IPMI support and is particularly concerning in server environments where IPMI is used for out-of-band management.
The fix implemented addresses this by removing the stale explicit put operation that was causing the reference count underflow, while preserving the necessary list_del() and ipmi_free_recv_msg() calls required for proper rollback operations. This solution aligns with CWE-129 Input Validation and CWE-131 Incorrect Calculation standards as it deals with improper reference counting mechanisms and memory management errors. The mitigation strategy follows established security practices by ensuring proper resource cleanup and preventing use-after-free conditions that could be exploited by attackers. This vulnerability also relates to ATT&CK technique T1068, which covers the exploitation of privilege escalation vulnerabilities through improper resource handling in kernel modules.
This type of reference counting error represents a common class of memory safety issues in kernel space programming where the complexity of concurrent access patterns and error recovery paths can lead to subtle but critical race conditions. The IPMI subsystem's architecture, which must handle multiple concurrent users and asynchronous event delivery, creates an environment where such timing-dependent errors can manifest. Proper synchronization mechanisms and careful reference counting are essential for maintaining system stability when dealing with shared kernel resources. The vulnerability demonstrates the importance of thorough testing of error recovery paths and the potential for seemingly minor code changes to introduce critical security flaws in low-level system components that handle hardware interface communications.