CVE-2026-81007

HighCVSS 7.1/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipmi: ipmb: validate write message length

ipmb_write() read message fields before validating the length byte.

A zero or short write can read uninitialized stack bytes.

A length smaller than the SMBus header underflows the block write length.

Require a non-empty buffer and the minimum IPMB request length.

Also require the length byte plus payload before parsing the message.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 51bd6f291583684f495ea498984dfc22049d7fd2, < 8990c7f6bfc1e7689b7012a7d4d0efb9f07a9c89; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < 94f8d20153e348c79bc14dc25f873470518892da; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < e527cd4e80066e1ed070fdc7c705bde340cdcc62; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < 7d66d54b974cff0a959e188af844d2d110422767; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < 60939bcda6f3f104ef456fdbf3cc5733c0720fb1; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < 5719431ca2b5fa26560bb38f6202f8b97fa3bbb0; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < a84c6e3d188f2c6e674910929eb790634299d6d5; >= 51bd6f291583684f495ea498984dfc22049d7fd2, < 53637506884dbd5c91a89b1a3547d99d80f8ed2c
LinuxLinux5.3

References

Timeline

Published
Sep 11, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-810087.8In the Linux kernel, the following vulnerability has been resolved: interconnect: Fix use after free in icc_get() and of_icc_get_by_index()CVE-2026-810117.1In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: pass validated element count to package parseCVE-2026-810128.4In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix off-by-one write in hp_get_string_from_buCVE-2026-81013In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read on empty password write vaCVE-2026-81014In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: fix heap OOB read in sk_store() and kek_storeCVE-2026-810157.8In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails aCVE-2026-810167.7In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Propagate SMU errors and validate S2D address amCVE-2026-810178.4In the Linux kernel, the following vulnerability has been resolved: platform/chrome: sensorhub: Bound the EC-reported sensor number Each ECVE-2026-81018In the Linux kernel, the following vulnerability has been resolved: platform/x86: think-lmi: Free system certificate signatures Multi-certCVE-2026-810197.4wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record.CVE-2026-810207.4wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. ACVE-2026-810215.3The SupportCandy WordPress plugin before 3.5.3 does not perform an authorization check on one of its support-ticket attachment download pat
CVE-2026-81007: High severity, CVSS 7.1 | Vulnix