CVE-2026-46177: ipmi: Add limits to event and receive message requests

Synopsis

This is a denial-of-service vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) driver. The driver can be reached over the network and requires no authentication, and the flaw allows a misbehaving or malicious BMC (Baseboard Management Controller) to keep the driver in an infinite fetch loop by never signaling completion, exhausting the host system. Successful exploitation causes the affected service or system to become unresponsive. A patched-image rebuild is available on HarborGuard for environments running affected kernel versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable IPMI driver is exposed over the network, meaning an attacker or a rogue BMC reachable over the network can trigger the loop condition.

• AuthenticationNot required

  No authentication is needed to trigger the condition; the misbehaving BMC behavior alone is sufficient to send the driver into a stuck state.

• Victim interactionNot required

  No user or administrator action is required; the driver processes BMC responses autonomously without any interactive step.

• Attack complexityDetail

  Attack complexity is low: the exploit requires no special conditions, race windows, or environmental tuning to trigger the infinite fetch loop.

Blast Radius

• The affected host's IPMI driver enters an infinite or near-infinite fetch loop, consuming CPU and kernel scheduling resources.
• The hung driver causes the IPMI subsystem to become unresponsive, blocking platform management operations such as sensor polling, fan control, and out-of-band management.
• Sustained resource exhaustion can render the host kernel unresponsive or force a system restart, causing a full denial of service for workloads running on that host.