SB20260912362 - NULL pointer dereference in Linux kernel char ipmi driver

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-81005)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper shutdown state management in the IPMI message handler failed-registration rollback path when asynchronous redo_bmc_reg work retries BMC device-ID probing after a failed registration. A local user can cause BMC device-ID retrieval to fail and trigger a NULL pointer dereference to cause a denial of service.

The issue occurs after the lower driver's shutdown callback has cleared the SI state machine data.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/53af3a8bae0a93c1342e1b5519812203332aca8e
• https://git.kernel.org/stable/c/6d920a75df9a83ab096b3cde7a643b656e4fdfeb
• https://git.kernel.org/stable/c/8ada17dd4c4ffd6b94621e735d77eda196ce118f
• https://git.kernel.org/stable/c/d4be659a3e56f4eb16039ab8a1162efea086a714