CVE-2026-72042

A flaw was found in the Linux kernel's Intelligent Platform Management Interface (IPMI) subsystem. An issue in the event delivery mechanism, specifically a reference count underflow, can lead to a use-after-free vulnerability. This occurs when a user's reference count is prematurely decremented during event delivery rollback, allowing for the potential dereferencing of freed memory. This could result in system instability or a denial of service.

Red Hat rates this vulnerability as Important because an authenticated local user with device access can trigger memory corruption within kernel space, potentially leading to local privilege escalation or complete system crashes. Exploitation requires direct interaction with the host IPMI interface, which typically restricts operational exposure to privileged accounts or administrative monitoring agents. Supported Red Hat Enterprise Linux releases are not affected by this flaw because the vulnerable code changes were never introduced into shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.