PT-2026-27687 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-03-28 · CVE-2026-23322

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw related to improper handling of error responses within the Intelligent Platform Management Interface (IPMI) component. Specifically, when the System Management Interrupt (SMI) sender encounters an error, the smi work() function delivers an error response but fails to properly clean up resources. This results in the intf->curr msg variable not being cleared, allowing the same message to be processed repeatedly. Subsequent calls to sender() with the same message can lead to list corruption, specifically a double addition to the user msgs list. This corruption ultimately causes a use-after-free condition when the memory is freed and reused, potentially leading to a NULL pointer dereference when accessing recv msg->done. The issue stems from failing to free the message and setting it to NULL upon a send error, as well as failing to free newmsg on a send error, resulting in a memory leak.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-23322

Affected Products

Linux Kernel

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23322.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-23322 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23322 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-23322 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23322 · Security Note
• https://ubuntu.com/security/CVE-2026-23322 · Vendor Advisory
• https://git.kernel.org/stable/c/594c11d0e1d445f580898a2b8c850f2e3f099368 · Patch
• https://git.kernel.org/stable/c/65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53 · Patch
• https://git.kernel.org/stable/c/c08ec55617cb9674a060a3392ea08391ab2a4f74 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23322 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23322 · Vendor Advisory
• https://twitter.com/CVEnew/status/2036763527684178217 · Twitter Post
• https://git.kernel.org/linus/594c11d0e1d445f580898a2b8c850f2e3f099368 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://twitter.com/CVEarity/status/2037926744255262985 · Twitter Post