{"id":"CVE-2026-81007","title":"ipmi: ipmb: validate write message length","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: validate write message length\n\nipmb_write() read message fields before validating the length byte.\n\nA zero or short write can read uninitialized stack bytes…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 94f8d20153e348c79bc14dc25f873470518892da","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < e527cd4e80066e1ed070fdc7c705bde340cdcc62","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 7d66d54b974cff0a959e188af844d2d110422767","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 60939bcda6f3f104ef456fdbf3cc5733c0720fb1","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < a84c6e3d188f2c6e674910929eb790634299d6d5","Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 53637506884dbd5c91a89b1a3547d99d80f8ed2c","Linux 5.3"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T11:59:40.685Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-81007","references":[{"url":"https://git.kernel.org/stable/c/8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89"},{"url":"https://git.kernel.org/stable/c/94f8d20153e348c79bc14dc25f873470518892da"},{"url":"https://git.kernel.org/stable/c/e527cd4e80066e1ed070fdc7c705bde340cdcc62"},{"url":"https://git.kernel.org/stable/c/7d66d54b974cff0a959e188af844d2d110422767"},{"url":"https://git.kernel.org/stable/c/60939bcda6f3f104ef456fdbf3cc5733c0720fb1"},{"url":"https://git.kernel.org/stable/c/5719431ca2b5fa26560bb38f6202f8b97fa3bbb0"},{"url":"https://git.kernel.org/stable/c/a84c6e3d188f2c6e674910929eb790634299d6d5"},{"url":"https://git.kernel.org/stable/c/53637506884dbd5c91a89b1a3547d99d80f8ed2c"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02587,"ingestedAt":"2026-09-14T15:23:07.454Z","slug":"CVE-2026-81007","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nipmi: ipmb: validate write message length\n\nipmb_write() read message fields before validating the length byte.\n\nA zero or short write can read uninitialized stack bytes.\n\nA length smaller than the SMBus header underflows the block write length.\n\nRequire a non-empty buffer and the minimum IPMB request length.\n\nAlso require the length byte plus payload before parsing the message.\n\n## Affected\n\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 94f8d20153e348c79bc14dc25f873470518892da`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < e527cd4e80066e1ed070fdc7c705bde340cdcc62`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 7d66d54b974cff0a959e188af844d2d110422767`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 60939bcda6f3f104ef456fdbf3cc5733c0720fb1`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < a84c6e3d188f2c6e674910929eb790634299d6d5`\n- `Linux >= 51bd6f291583684f495ea498984dfc22049d7fd2 < 53637506884dbd5c91a89b1a3547d99d80f8ed2c`\n- `Linux 5.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":153202,"id":"CVE-2026-81007","ts":1789285349529,"field":"cvss","old":null,"new":"7.1"},{"seq":153201,"id":"CVE-2026-81007","ts":1789285349529,"field":"severity","old":"none","new":"high"}]}