CVE-2026-23322: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23322 is a use-after-free and list corruption vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem. It was disclosed on March 25, 2026, and affects Linux kernel versions 6.18.1 through 6.18.16, 6.19 through 6.19.6, and 7.0 release candidates up to rc7. The flaw resides in the smi_work() function, which fails to properly clean up state when the SMI sender returns an error, leading to double-queuing of the same message and subsequent memory corruption. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-416 (Use After Free), triggered by improper cleanup logic in the smi_work() function of the Linux kernel IPMI subsystem. When sender() returns an error, deliver_err_response() queues recv_msg for delivery, but the function then executes a goto restart without clearing intf->curr_msg or nullifying newmsg. On the next iteration, sender() is called again with the same message; if it fails again, deliver_err_response() attempts to add the already-queued recv_msg to the user_msgs list a second time, causing a "list_add double add" kernel list corruption. The corrupted list subsequently leads to use-after-free when memory is freed and reused, and ultimately a NULL pointer dereference when accessing recv_msg->done. Exploitation requires local access with low privileges and no user interaction (Red Hat Bugzilla, Feedly).

Successful exploitation allows a local attacker with low privileges to trigger kernel crashes via NULL pointer dereference and memory corruption, impacting system availability. The use-after-free condition also poses risks to kernel memory integrity and confidentiality, and in certain scenarios could potentially be leveraged for local privilege escalation. The vulnerability affects the kernel's IPMI subsystem, which is commonly present on server hardware for out-of-band management, making it relevant to data center and cloud infrastructure environments (Feedly).

There is no known public proof-of-concept exploit or evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. Detection coverage exists via Nessus plugin 311340 (Tenable).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing list_add double add corruption messages or BUG: kernel NULL pointer dereference traces originating from the IPMI subsystem (ipmi_si or ipmi_msghandler modules).
• Process/Kernel: Unexpected kernel panics or oops events referencing smi_work(), deliver_err_response(), or recv_msg->done in the stack trace.
• System: Sudden system instability or reboots on hosts with IPMI interfaces active, particularly following repeated IPMI message send failures.

Apply the upstream kernel patches available via git.kernel.org for the affected stable branches (commits 594c11d0, 65ff5d1e, c08ec556). Fixed versions are Linux kernel 6.18.17 or later, 6.19.7 or later, and 7.0-rc2 or later (Red Hat Bugzilla, Feedly). Amazon Linux 2023 users should apply the update referenced in ALAS2023-2026-1596. As a workaround where patching is not immediately possible, restrict access to IPMI interfaces to trusted users only, or disable the IPMI kernel modules (ipmi_si, ipmi_msghandler) if IPMI functionality is not required.