CVE-2026-72040

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipmi: fix refcount leak in i_ipmi_request()

When a caller provides a `supplied_recv` message to i_ipmi_request(),

the function increments the user's `nr_msgs` reference count. If an

error occurs later, the out_err cleanup path only frees the recv_msg

if the function allocated it itself (i.e., !supplied_recv). In the

supplied_recv case the cleanup is skipped, leaving the reference count

elevated. The caller ipmi_request_supply_msgs() does not release the

supplied_recv on error, so the reference is permanently leaked.

Fix this by explicitly reverting the reference count operations when a

supplied recv_msg with a valid user pointer is present in the error

path: decrement nr_msgs and drop the user's kref.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References