CVE-2026-72042 ipmi: Fix user refcount underflow in event delivery
A use-after-free vulnerability in the Linux kernel IPMI driver allows attackers to cause denial of service or potentially execute code via event delivery failures.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-72042?
CVE-2026-72042 is a high-severity use after free vulnerability in Linux, published on 15 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Fix user refcount underflow in event delivery
ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the receive message, and ipmi_free_recv_msg() drops it again. If event delivery fails after allocating receive messages for earlier users, handle_read_event_rsp() rolls those messages back with ipmi_free_recv_msg().
That rollback path still drops user->refcount explicitly after freeing each message. The extra put can free a user that remains linked on intf->users, so later event delivery may dereference a freed user or trip refcount_t's addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire another reference.
Remove the stale explicit put and the now-dead user assignment. Keep the list_del() and ipmi_free_recv_msg() calls; they are the required rollback operations.
Which versions are affected by CVE-2026-72042?
How do I fix CVE-2026-72042?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-72042 being exploited?
There is no known exploitation of CVE-2026-72042 in the wild and no public exploit code.
Sources
Also known as AZL-96366, BELL-CVE-2026-72042, DEBIAN-CVE-2026-72042, GHSA-vqpc-pm2x-2835, UBUNTU-CVE-2026-72042.