CVE-2026-72040

A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. When a caller provides a message to the i_ipmi_request() function, a reference count is incremented. However, if an error occurs during this process, the reference count is not properly decremented, resulting in a permanent resource leak. This resource leak could allow a local attacker to cause a denial of service (DoS) condition on the system.

This flaw is rated with a Low severity impact because exploiting the reference count leak requires local privileges to interact with the IPMI message handler, and an attack can only cause resource exhaustion without compromising system integrity or confidentiality. Furthermore, the vulnerable code introduced in upstream Linux kernel commits was never backported to Red Hat Enterprise Linux, leaving supported versions unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.