CVE-2026-46177 Details
Description
In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a time. In addition, an si interface has an attn state it can return from the hardware which is supposed to cause a flag fetch to see if the driver needs to fetch events or message or a few other things. If the attn bit gets stuck, it's a similar problem. So allow messages in between flag fetches so the driver itself doesn't get stuck. This is a more general fix than the previous fix for the specific bad BMC, but should fix the more general issue of a BMC that won't stop saying it has data. This has been there from the beginning of the driver. It's not a bug per-se, but it is accounting for bugs in BMCs.
A vulnerability in the Linux kernel's IPMI driver could lead to inefficient message handling. The driver previously fetched events and messages continuously until the Baseboard Management Controller (BMC) indicated completion. This behavior could cause issues with BMCs that do not properly signal when they are done. The vulnerability allows a BMC to falsely report available data, potentially leading to a communication bottleneck. The problem arises from the driver's inability to manage repeated fetch requests, especially if the BMC gets 'stuck' indicating there are messages or events to be processed.
Users can update to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for updating the kernel can be found in the official Linux kernel documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/112df8e631636cafda64dcee4561daf09ce74a4a | kernel.org | Patch |
| https://git.kernel.org/stable/c/304b56883b7eff73eb606c35d062c8101aaf5471 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3d37d2165df9504ea99d9e6181552dc4d2d1ab37 | kernel.org | Patch |
| https://git.kernel.org/stable/c/67c44e0deba936d5edaebea356b4589eb43acb5c | kernel.org | Patch |
| https://git.kernel.org/stable/c/9059dc94421e1d4f8e5844204608b37ebfddb3da | kernel.org | Patch |
| https://git.kernel.org/stable/c/c024167fb00489baee08c72182ca2e7dc5fb9f20 | kernel.org | Patch |
| https://git.kernel.org/stable/c/c4cca236968683eb0d59abfb12d5c7e4d8514227 | kernel.org | Patch |
| https://git.kernel.org/stable/c/e20212b431bef217d3886b86bbc90cc3ed00de68 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.12.1, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.88 >= 6.13, < 6.18.30 >= 6.19, < 7.0.7 2.6.12 - 2.6.12 rc2 2.6.12 rc3 2.6.12 rc4 2.6.12 rc5 7.1 rc1 7.1 rc2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 10, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 28, 2026 | New CVE Received | kernel.org |