CVE-2026-72040 ipmi: fix refcount leak in i_ipmi_request()
A refcount leak in the Linux kernel IPMI driver allows local attackers to cause memory exhaustion and denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72040?
CVE-2026-72040 is a memory corruption vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipmi: fix refcount leak in i_ipmi_request()
When a caller provides a `supplied_recv` message to i_ipmi_request(), the function increments the user's `nr_msgs` reference count. If an error occurs later, the out_err cleanup path only frees the recv_msg if the function allocated it itself (i.e., !supplied_recv). In the supplied_recv case the cleanup is skipped, leaving the reference count elevated. The caller ipmi_request_supply_msgs() does not release the supplied_recv on error, so the reference is permanently leaked.
Fix this by explicitly reverting the reference count operations when a supplied recv_msg with a valid user pointer is present in the error path: decrement nr_msgs and drop the user's kref.
Which versions are affected by CVE-2026-72040?
How do I fix CVE-2026-72040?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-72040 being exploited?
There is no known exploitation of CVE-2026-72040 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72040, DEBIAN-CVE-2026-72040, GHSA-j63g-h4gq-q67f, UBUNTU-CVE-2026-72040.