CVE-2026-72040
In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in i_ipmi_request() When a caller provides a `supplied_recv` message to i_ipmi_request(), the function increments the user's `nr_msgs` reference count. If an error occurs later, the out_err cleanup path only frees the recv_msg if the function allocated it itself (i.e., !supplied_recv). In the supplied_recv case the cleanup is skipped, leaving the reference count elevated. The caller ipmi_request_supply_msgs() does not release the supplied_recv on error, so the reference is permanently leaked. Fix this by explicitly reverting the reference count operations when a supplied recv_msg with a valid user pointer is present in the error path: decrement nr_msgs and drop the user's kref.
Affected versions
Linux kernel versions
6.6.113,
6.12.54,
6.1.157,
6.17.4,
6.18
and later are affected. Fixed in
6.6.148,
6.12.101,
6.18.40,
7.1.5,
7.2-rc1
and their respective stable series.
References
5 totalFrequently asked questions
-
What is CVE-2026-72040?
CVE-2026-72040 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 6.6.113 onward and has been patched in 6.6.148, 6.12.101, 6.18.40 and others. CVE-2026-72040 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-72040?
Yes. CVE-2026-72040 has been patched. Fixed versions include 6.6.148, 6.12.101, 6.18.40 and others. If you are running Linux kernel 6.6.113 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-72040 actively exploited?
No. CVE-2026-72040 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.