Vulnerability-Lookup

GHSA-668M-Q5H4-JFJC

Vulnerability from github – Published: 2026-03-25 12:30 – Updated: 2026-03-25 12:30

Details

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix use-after-free and list corruption on sender error

The analysis from Breno:

When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to restart without cleaning up properly:

intf->curr_msg is not cleared, so no new message is pulled
newmsg still points to the message, causing sender() to be called again with the same message
If sender() fails again, deliver_err_response() is called with the same recv_msg that was already queued for delivery

This causes list_add corruption ("list_add double add") because the recv_msg is added to the user_msgs list twice. Subsequently, the corrupted list leads to use-after-free when the memory is freed and reused, and eventually a NULL pointer dereference when accessing recv_msg->done.

The buggy sequence:

sender() fails -> deliver_err_response(recv_msg) // recv_msg queued for delivery -> goto restart // curr_msg not cleared! sender() fails again (same message!) -> deliver_err_response(recv_msg) // tries to queue same recv_msg -> LIST CORRUPTION

Fix this by freeing the message and setting it to NULL on a send error. Also, always free the newmsg on a send error, otherwise it will leak.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-23322"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-03-25T11:16:29Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix use-after-free and list corruption on sender error\n\nThe analysis from Breno:\n\nWhen the SMI sender returns an error, smi_work() delivers an error\nresponse but then jumps back to restart without cleaning up properly:\n\n1. intf-\u003ecurr_msg is not cleared, so no new message is pulled\n2. newmsg still points to the message, causing sender() to be called\n   again with the same message\n3. If sender() fails again, deliver_err_response() is called with\n   the same recv_msg that was already queued for delivery\n\nThis causes list_add corruption (\"list_add double add\") because the\nrecv_msg is added to the user_msgs list twice. Subsequently, the\ncorrupted list leads to use-after-free when the memory is freed and\nreused, and eventually a NULL pointer dereference when accessing\nrecv_msg-\u003edone.\n\nThe buggy sequence:\n\n  sender() fails\n    -\u003e deliver_err_response(recv_msg)  // recv_msg queued for delivery\n    -\u003e goto restart                    // curr_msg not cleared!\n  sender() fails again (same message!)\n    -\u003e deliver_err_response(recv_msg)  // tries to queue same recv_msg\n    -\u003e LIST CORRUPTION\n\nFix this by freeing the message and setting it to NULL on a send error.\nAlso, always free the newmsg on a send error, otherwise it will leak.",
  "id": "GHSA-668m-q5h4-jfjc",
  "modified": "2026-03-25T12:30:22Z",
  "published": "2026-03-25T12:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23322"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/594c11d0e1d445f580898a2b8c850f2e3f099368"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/c08ec55617cb9674a060a3392ea08391ab2a4f74"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-23322 (GCVE-0-2026-23322)

Vulnerability from cvelistv5 – Published: 2026-03-25 10:27 – Updated: 2026-03-25 10:27

Title

ipmi: Fix use-after-free and list corruption on sender error

Summary

In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to restart without cleaning up properly: 1. intf->curr_msg is not cleared, so no new message is pulled 2. newmsg still points to the message, causing sender() to be called again with the same message 3. If sender() fails again, deliver_err_response() is called with the same recv_msg that was already queued for delivery This causes list_add corruption ("list_add double add") because the recv_msg is added to the user_msgs list twice. Subsequently, the corrupted list leads to use-after-free when the memory is freed and reused, and eventually a NULL pointer dereference when accessing recv_msg->done. The buggy sequence: sender() fails -> deliver_err_response(recv_msg) // recv_msg queued for delivery -> goto restart // curr_msg not cleared! sender() fails again (same message!) -> deliver_err_response(recv_msg) // tries to queue same recv_msg -> LIST CORRUPTION Fix this by freeing the message and setting it to NULL on a send error. Also, always free the newmsg on a send error, otherwise it will leak.

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/c08ec55617cb9674a…
	https://git.kernel.org/stable/c/65ff5d1e4410df05e…
	https://git.kernel.org/stable/c/594c11d0e1d445f58…

Impacted products

Vendor

Product

Version

Linux

Affected: 9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 , < c08ec55617cb9674a060a3392ea08391ab2a4f74 (git)
Affected: 9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 , < 65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53 (git)
Affected: 9cf93a8fa9513c6d3cc65bdd50e05c1355cef322 , < 594c11d0e1d445f580898a2b8c850f2e3f099368 (git)

Linux

Affected: 6.18
Unaffected: 0 , < 6.18 (semver)
Unaffected: 6.18.17 , ≤ 6.18.* (semver)
Unaffected: 6.19.7 , ≤ 6.19.* (semver)
Unaffected: 7.0-rc2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/ipmi/ipmi_msghandler.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c08ec55617cb9674a060a3392ea08391ab2a4f74",
              "status": "affected",
              "version": "9cf93a8fa9513c6d3cc65bdd50e05c1355cef322",
              "versionType": "git"
            },
            {
              "lessThan": "65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53",
              "status": "affected",
              "version": "9cf93a8fa9513c6d3cc65bdd50e05c1355cef322",
              "versionType": "git"
            },
            {
              "lessThan": "594c11d0e1d445f580898a2b8c850f2e3f099368",
              "status": "affected",
              "version": "9cf93a8fa9513c6d3cc65bdd50e05c1355cef322",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/ipmi/ipmi_msghandler.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.18"
            },
            {
              "lessThan": "6.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.17",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0-rc2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.17",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.7",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0-rc2",
                  "versionStartIncluding": "6.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: Fix use-after-free and list corruption on sender error\n\nThe analysis from Breno:\n\nWhen the SMI sender returns an error, smi_work() delivers an error\nresponse but then jumps back to restart without cleaning up properly:\n\n1. intf-\u003ecurr_msg is not cleared, so no new message is pulled\n2. newmsg still points to the message, causing sender() to be called\n   again with the same message\n3. If sender() fails again, deliver_err_response() is called with\n   the same recv_msg that was already queued for delivery\n\nThis causes list_add corruption (\"list_add double add\") because the\nrecv_msg is added to the user_msgs list twice. Subsequently, the\ncorrupted list leads to use-after-free when the memory is freed and\nreused, and eventually a NULL pointer dereference when accessing\nrecv_msg-\u003edone.\n\nThe buggy sequence:\n\n  sender() fails\n    -\u003e deliver_err_response(recv_msg)  // recv_msg queued for delivery\n    -\u003e goto restart                    // curr_msg not cleared!\n  sender() fails again (same message!)\n    -\u003e deliver_err_response(recv_msg)  // tries to queue same recv_msg\n    -\u003e LIST CORRUPTION\n\nFix this by freeing the message and setting it to NULL on a send error.\nAlso, always free the newmsg on a send error, otherwise it will leak."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-25T10:27:15.954Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c08ec55617cb9674a060a3392ea08391ab2a4f74"
        },
        {
          "url": "https://git.kernel.org/stable/c/65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53"
        },
        {
          "url": "https://git.kernel.org/stable/c/594c11d0e1d445f580898a2b8c850f2e3f099368"
        }
      ],
      "title": "ipmi: Fix use-after-free and list corruption on sender error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23322",
    "datePublished": "2026-03-25T10:27:15.954Z",
    "dateReserved": "2026-01-13T15:37:45.996Z",
    "dateUpdated": "2026-03-25T10:27:15.954Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-668M-Q5H4-JFJC

CVE-2026-23322 (GCVE-0-2026-23322)

Tags

Sightings

Nomenclature