CVE-2026-81007
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: ipmi: ipmb: validate write message length ipmb_write() read message fields before validating the length byte. A zero or short write can read uninitialized stack bytes. A length smaller than the SMBus header underflows the block write length. Require a non-empty buffer and the minimum IPMB request length. Also require the length byte plus payload before parsing the message.
Severity
HIGH
CVSS score
7.1
(v3.1)
Vulnerability status
Received
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-09-11 20:19:09.443000
Last modified
2026-10-19 09:17:34.017000
View original CVE JSON
{
"id": "CVE-2026-81007",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-11T20:19:09.443",
"lastModified": "2026-10-19T09:17:34.017",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: validate write message length\n\nipmb_write() read message fields before validating the length byte.\n\nA zero or short write can read uninitialized stack bytes.\n\nA length smaller than the SMBus header underflows the block write length.\n\nRequire a non-empty buffer and the minimum IPMB request length.\n\nAlso require the length byte plus payload before parsing the message."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/char/ipmi/ipmb_dev_int.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "94f8d20153e348c79bc14dc25f873470518892da",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "e527cd4e80066e1ed070fdc7c705bde340cdcc62",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "7d66d54b974cff0a959e188af844d2d110422767",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "60939bcda6f3f104ef456fdbf3cc5733c0720fb1",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "5719431ca2b5fa26560bb38f6202f8b97fa3bbb0",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "a84c6e3d188f2c6e674910929eb790634299d6d5",
"versionType": "git",
"status": "affected"
},
{
"version": "51bd6f291583684f495ea498984dfc22049d7fd2",
"lessThan": "53637506884dbd5c91a89b1a3547d99d80f8ed2c",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/char/ipmi/ipmb_dev_int.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "5.3",
"status": "affected"
},
{
"version": "0",
"lessThan": "5.3",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.10.270",
"lessThanOrEqual": "5.10.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "5.15.221",
"lessThanOrEqual": "5.15.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.188",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.157",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.109",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.50",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.4",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.2
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/53637506884dbd5c91a89b1a3547d99d80f8ed2c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/5719431ca2b5fa26560bb38f6202f8b97fa3bbb0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/60939bcda6f3f104ef456fdbf3cc5733c0720fb1",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7d66d54b974cff0a959e188af844d2d110422767",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/94f8d20153e348c79bc14dc25f873470518892da",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a84c6e3d188f2c6e674910929eb790634299d6d5",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e527cd4e80066e1ed070fdc7c705bde340cdcc62",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}