CVE-2026-85509: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-85509 is a stack-based buffer overflow vulnerability in FreeIPMI before version 1.6.19, located in the _read_fru_data function within libfreeipmi/fru/ipmi-fru.c. The flaw is triggered when a Baseboard Management Controller (BMC) returns more bytes than requested during FRU (Field Replaceable Unit) data reads. It was disclosed publicly on August 28, 2026 via the oss-security mailing list and published to the NVD on September 4, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Openwall).

The root cause is classified as CWE-121 (Stack-based Buffer Overflow): the _read_fru_data function in libfreeipmi/fru/ipmi-fru.c does not properly validate the length of data returned by a BMC before copying it into a fixed-size stack buffer. An attacker controlling or impersonating a BMC can return an oversized response, overwriting adjacent stack memory. Because the attack vector is network-based, requires no privileges, and no user interaction, exploitation preconditions are minimal — the attacker only needs network access to a FreeIPMI instance communicating with a malicious or compromised BMC (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the FreeIPMI process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. An attacker could leverage this to install backdoors, exfiltrate sensitive hardware management data, or pivot to other systems on the management network. Given that BMC interfaces often have privileged access to underlying hardware, the blast radius of exploitation could extend beyond the host running FreeIPMI (GitHub Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify hosts running FreeIPMI (versions before 1.6.19) that communicate with BMC interfaces, using network scanning tools such as Nmap targeting IPMI ports (UDP 623, TCP 623).
2. Position as malicious BMC: Set up a rogue BMC or perform a man-in-the-middle attack on the IPMI network segment to intercept and respond to FRU data requests from the FreeIPMI client.
3. Craft oversized FRU response: When the FreeIPMI client sends a Get FRU Inventory Area Info or Read FRU Data IPMI command, respond with a payload that exceeds the expected byte count, targeting the fixed-size stack buffer in _read_fru_data.
4. Trigger buffer overflow: The oversized response causes _read_fru_data in libfreeipmi/fru/ipmi-fru.c to write beyond the stack buffer boundary, overwriting the return address or other control data.
5. Achieve code execution: With control of the instruction pointer, redirect execution to attacker-controlled shellcode or a ROP chain to execute arbitrary commands with the privileges of the FreeIPMI process (Openwall, GitHub Advisory).

• Network: Unexpected or malformed IPMI responses on UDP/TCP port 623 with FRU data payloads exceeding declared sizes; unusual IPMI traffic originating from unknown BMC IP addresses.
• Process: Abnormal child processes spawned by FreeIPMI utilities (e.g., ipmi-fru) such as shells (/bin/bash, /bin/sh), network tools (curl, wget, nc), or unexpected outbound connections.
• Logs: System logs (/var/log/syslog, /var/log/messages) showing segmentation faults or crashes in FreeIPMI processes; application-level errors referencing ipmi-fru.c or _read_fru_data.
• File System: New or modified files in directories writable by the FreeIPMI process user; unexpected cron jobs or systemd units created after FreeIPMI execution.

Upgrade FreeIPMI to version 1.6.19 or later, which includes fixes for this and other potential buffer overflows identified through code analysis (Openwall). The patched release is available at https://ftp.gnu.org/gnu/freeipmi/freeipmi-1.6.19.tar.gz. As a network-level workaround, restrict access to BMC communication channels using firewall rules and network segmentation to ensure only trusted hosts can respond to IPMI requests, reducing exposure to rogue BMC responses (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was forwarded to the oss-security mailing list by Chad Dougherty of Carnegie Mellon University, drawing attention from the open-source security community (Openwall). Red Hat opened a tracking bug and classified the issue as high severity, indicating downstream distribution impact is being assessed (Red Hat Bugzilla). No significant social media commentary or broader media coverage has been identified at this time.