CVE-2026-81007 json
ipmi: ipmb: validate write message length
published 2026-09-11 58 d ago modified 2026-10-19 20 d ago also EUVD-2026-76330
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.1%
- EPSS 0.1% chance of exploitation in 30 days, percentile 2%
- public exploits
- 0
- none known
Summary
In the Linux kernel, the following vulnerability has been resolved:
ipmi: ipmb: validate write message length
ipmb_write() read message fields before validating the length byte.
A zero or short write can read uninitialized stack bytes.
A length smaller than the SMBus header underflows the block write length.
Require a non-empty buffer and the minimum IPMB request length.
Also require the length byte plus payload before parsing the message.
Patch / fix
- Linux Linux 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3
- linux Debian 12 6.1.190-1
- linux Debian 13 6.12.111-1
- linux Debian 14 7.2.6-1
- linux-6.12 Debian 12 6.12.111-1~deb12u1
debian advisories DEBIAN-CVE-2026-81007
- linux Ubuntu 22.04 LTS 5.15.0-202.212
- linux Ubuntu 26.04 LTS 7.0.0-42.42
- linux-aws Ubuntu 22.04 LTS 5.15.0-1119.126
- linux-aws Ubuntu 26.04 LTS 7.0.0-1016.17
- linux-gcp Ubuntu 22.04 LTS 5.15.0-1120.130
- linux-gcp Ubuntu 26.04 LTS 7.0.0-1016.18
- linux-gke Ubuntu 22.04 LTS 5.15.0-1115.121
- linux-ibm Ubuntu 22.04 LTS 5.15.0-1113.117
ubuntu advisories UBUNTU-CVE-2026-81007
Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0
- kernel-source Linux Micro 6.0 6.4.0-159998.55.1
- kernel-default Linux Micro 6.0 6.4.0-159998.55.1
- kernel-kvmsmall Linux Micro 6.0 6.4.0-159998.55.1
- kernel-default-base Linux Micro 6.0 6.4.0-159998.55.1.159998.21.42
- kernel-64kb SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1
- kernel-syms SLE Module for Development Tools 15 SP7 6.4.0-150700.53.90.1
- kernel-azure SLE Module for Public Cloud 15 SP7 6.4.0-150700.53.90.1
- kernel-source SLE Module for Development Tools 15 SP7, SLE Module for Basesystem 15 SP7 6.4.0-150700.53.90.1
suse advisories SUSE-SU-2026:24550-1SUSE-SU-2026:5091-1
- kernel-source openSUSE Tumbleweed 7.2.6-1.1
opensuse advisories openSUSE-SU-2026:11805-1
- git.kernel.org/stable/c/8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89 commit
- git.kernel.org/stable/c/94f8d20153e348c79bc14dc25f873470518892da commit
- git.kernel.org/stable/c/e527cd4e80066e1ed070fdc7c705bde340cdcc62 commit
- git.kernel.org/stable/c/7d66d54b974cff0a959e188af844d2d110422767 commit
- git.kernel.org/stable/c/60939bcda6f3f104ef456fdbf3cc5733c0720fb1 commit
- git.kernel.org/stable/c/5719431ca2b5fa26560bb38f6202f8b97fa3bbb0 commit
- git.kernel.org/stable/c/a84c6e3d188f2c6e674910929eb790634299d6d5 commit
- git.kernel.org/stable/c/53637506884dbd5c91a89b1a3547d99d80f8ed2c commit
Exploit prediction
0.13% chance of exploitation in the next 30 days, higher than 2% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H |
Affected products
- Linux Linux
Classification
- Technology feeds
References
- git.kernel.org /stable/c/8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89
- git.kernel.org /stable/c/94f8d20153e348c79bc14dc25f873470518892da
- git.kernel.org /stable/c/e527cd4e80066e1ed070fdc7c705bde340cdcc62
- git.kernel.org /stable/c/7d66d54b974cff0a959e188af844d2d110422767
- git.kernel.org /stable/c/60939bcda6f3f104ef456fdbf3cc5733c0720fb1
- git.kernel.org /stable/c/5719431ca2b5fa26560bb38f6202f8b97fa3bbb0
- git.kernel.org /stable/c/a84c6e3d188f2c6e674910929eb790634299d6d5
- git.kernel.org /stable/c/53637506884dbd5c91a89b1a3547d99d80f8ed2c
Sources
- CVE List CVE-2026-81007
- NVD CVE-2026-81007
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.