CVE-2026-85509: 
Alma Linux vulnerability analysis and mitigation

CVE-2026-85509 is a stack-based buffer overflow vulnerability in FreeIPMI's _read_fru_data function within libfreeipmi/fru/ipmi-fru.c, triggered when a Baseboard Management Controller (BMC) returns more bytes than requested during FRU data reads. It affects all FreeIPMI versions before 1.6.19 and was publicly disclosed on September 4, 2026, following the release of FreeIPMI 1.6.19 on August 27, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, ENISA EUVD).

The root cause is a stack-based buffer overflow (CWE-121) in the _read_fru_data function in libfreeipmi/fru/ipmi-fru.c. When FreeIPMI queries a BMC for FRU (Field Replaceable Unit) data, it allocates a fixed-size stack buffer for the response; if the BMC returns more bytes than requested, the excess data overflows the buffer. An attacker controlling or spoofing a BMC can craft an oversized response to trigger this overflow without any authentication or user interaction, as the attack vector is network-accessible with low complexity (oss-security, GitHub Advisory). The fix was included in FreeIPMI 1.6.19, which addressed multiple potential buffer overflows identified through code analysis (oss-security).

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary code with the privileges of the FreeIPMI process, resulting in full compromise of confidentiality, integrity, and availability of the affected system. Because FreeIPMI is commonly used in data center and server management environments, exploitation could enable lateral movement across BMC-connected infrastructure, access to sensitive hardware management data, or disruption of server operations. The SSVC assessment classifies the technical impact as "total" and the vulnerability as automatable (ENISA EUVD, GitHub Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The CVE status is listed as "Deferred" and the SSVC exploitation field is "none." The EPSS score is approximately 0.388%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Detection is available via Nessus plugin 342824 (Tenable).

1. Reconnaissance: Identify systems running FreeIPMI versions prior to 1.6.19 that are connected to a BMC, using network scanners or Nessus plugin 342824 to detect vulnerable instances.
2. Position for BMC spoofing or compromise: Gain a network position where the attacker can intercept or respond to IPMI FRU data requests, either by compromising the BMC directly, performing ARP spoofing, or controlling a rogue BMC on the same management network segment.
3. Trigger FRU data request: Cause the FreeIPMI client to initiate a FRU data read operation (e.g., via ipmi-fru tool or a monitoring daemon using libfreeipmi).
4. Send oversized BMC response: Craft and return a malicious BMC response to the FRU data query that contains more bytes than the FreeIPMI client requested, overflowing the fixed-size stack buffer in _read_fru_data.
5. Achieve code execution: Control the stack overflow to overwrite the return address or function pointer, redirecting execution to attacker-controlled shellcode or a ROP chain, gaining code execution with the privileges of the FreeIPMI process (oss-security, GitHub Advisory).

• Network: Unexpected or anomalous IPMI traffic on UDP/623 or TCP/623 from unknown BMC addresses; oversized FRU data responses from BMC endpoints exceeding standard FRU record sizes.
• Process: Unusual child processes spawned by FreeIPMI tools (e.g., ipmi-fru, ipmimonitoring) such as shells (/bin/bash, /bin/sh), network utilities (curl, wget, nc), or other unexpected executables.
• Logs: Crash reports or core dumps from FreeIPMI processes; segmentation fault entries in system logs (/var/log/syslog, /var/log/messages) associated with ipmi-fru or libfreeipmi.
• File System: Unexpected files written to directories accessible by the FreeIPMI service account; new cron jobs or systemd timers created after FreeIPMI process execution.

The primary remediation is to upgrade FreeIPMI to version 1.6.19 or later, which includes fixes for this and other potential buffer overflows identified through code analysis (oss-security). Microsoft has also released a patch for the affected Azure Linux 3 package (azl3_freeipmi_1.6.18-1) via the September 2026 Patch Tuesday update (Microsoft MSRC). As a workaround, restrict network access to BMC communication channels (IPMI ports UDP/TCP 623) using firewall rules and implement network segmentation to isolate BMC management networks from untrusted systems, limiting exposure to potentially malicious BMC responses (GitHub Advisory).

The vulnerability was disclosed via the oss-security mailing list by Chad Dougherty, forwarding the official FreeIPMI 1.6.19 release announcement from Al Chu at Lawrence Livermore National Laboratory, which noted the release "includes several fixes for potential buffer overflows" (oss-security). The vulnerability was included in coverage of Microsoft's September 2026 Patch Tuesday, which addressed 966 flaws (BleepingComputer). Fedora also issued an advisory for the updated FreeIPMI package (Linux Security).