CVE-2026-43221

What it actually does

This Linux kernel flaw affects the IPMI/IPMB handling path. The IPMB handler did not initialize the byte count returned for an I2C read operation, allowing the I2C bus driver to return an uninitialized value. A local, low-privileged user with access to the relevant I2C/IPMI interfaces may be able to trigger incorrect kernel-side behavior that can lead to a high-impact availability failure, such as a kernel fault, hang, or service disruption. The CVSS vector indicates local access is required, no user interaction is needed, and confidentiality and integrity are not expected to be directly impacted.

Why it matters to the business

Systems that expose IPMI/IPMB or I2C device interfaces to local users may be vulnerable to local denial-of-service, potentially causing server instability, outages, or interrupted workloads. The risk is highest on Linux servers using IPMI management functionality, embedded platforms, appliances, or environments where non-administrative users, containers, or service accounts can access I2C/IPMI device nodes. This issue is not known to be exploited in the wild, is not in the CISA KEV catalog, and has a low EPSS score, so remediation should be prioritized as part of normal kernel patch cycles unless affected interfaces are exposed to untrusted local users.

How an attack unfolds

An attacker first needs local execution on a vulnerable Linux system, either through a shell, compromised service account, container escape-adjacent access, or another foothold that can interact with exposed I2C/IPMI device interfaces. The attacker identifies available I2C/IPMI device nodes and attempts to issue read operations through the affected IPMB handling path. Because the kernel handler did not initialize the returned byte count for this case, the bus driver may consume an undefined value and enter an erroneous state. Depending on kernel configuration, hardware, and driver behavior, this can result in a kernel error, bus instability, device malfunction, or system crash. There is no indication from the provided data that this vulnerability enables remote code execution, privilege escalation, or direct data theft.

How to fix it

Upgrade the Linux kernel to a vendor-supported release that includes the upstream fix for the IPMI/IPMB handler initialization issue. No exact fixed versions were provided, so use distribution vendor advisories for Red Hat, Ubuntu, Debian, SUSE, Amazon Linux, Oracle Linux, Alpine, Android/embedded Linux vendors, or appliance-specific firmware providers to identify the corrected kernel package. Where immediate patching is not possible, reduce exposure by restricting access to I2C and IPMI device nodes, limiting membership in groups that can access those devices, disabling unnecessary IPMI/IPMB/I2C functionality, removing or preventing loading of unused related kernel modules where operationally safe, and isolating workloads so untrusted local users or containers cannot interact with host device interfaces.

How to confirm the fix worked

Confirm the running kernel version includes the vendor patch for this issue, not only that an updated package is installed. Reboot into the patched kernel if required. Validate exposure by checking whether IPMI/IPMB/I2C kernel functionality is loaded and whether device nodes such as I2C or IPMI interfaces are accessible to non-root users or application accounts. Review vendor security advisories and kernel changelogs for the IPMI/IPMB fix described as initializing event-handler read bytes. After mitigation, verify that unnecessary modules are not loaded, device-node permissions are restricted, and local users without administrative privileges cannot perform reads against the affected interfaces.

Typical attack path

1. Obtain local code execution on a Linux host that includes the affected IPMI/IPMB kernel functionality.
2. Check whether I2C/IPMI interfaces are present and accessible, such as exposed device nodes or management-related kernel modules.
3. Use local tooling or custom code to issue I2C read operations that reach the IPMB event-handler path.
4. Trigger the uninitialized return-value condition in the kernel/bus driver interaction.
5. Cause degraded availability, kernel instability, device-management disruption, or a system crash.

How to detect it

There are no public exploit indicators or known threat-actor campaigns associated with this issue in the provided data. Detection should focus on evidence of local abuse of I2C/IPMI interfaces and resulting kernel instability. Review system logs, kernel logs, audit logs, and endpoint telemetry for unexpected access to I2C or IPMI device nodes, unusual execution of I2C/IPMI utilities by non-administrative accounts, kernel oops or panic events involving IPMI/IPMB/I2C drivers, I2C bus read errors, watchdog resets, and unexplained reboots. Useful log sources include journald, syslog, kern.log, dmesg archives, auditd, EDR process telemetry, sudo logs, and shell history where available. If auditd is deployed, search for read/open/ioctl activity against /dev/i2c-* and /dev/ipmi* by accounts that do not normally perform hardware monitoring or platform management.

• /dev/i2c-
• /dev/ipmi
• /dev/ipmi0
• /dev/ipmidev/
• i2cget
• i2cdump
• i2ctransfer
• ipmitool
• modprobe ipmi
• modprobe ipmb
• ipmi_si
• ipmi_devintf
• ipmi_msghandler
• ipmb-dev-int
• kernel: Oops
• kernel panic
• BUG: kernel NULL pointer dereference
• watchdog: watchdog did not stop
• i2c i2c-
• ipmi

What your security team should do

• Inventory Linux systems using IPMI, IPMB, I2C, BMC-adjacent management, embedded-management, or hardware-monitoring functionality.
• Patch affected systems through the normal kernel update process, prioritizing multi-user servers, appliances, shared compute, and systems where untrusted local users or containers may access host devices.
• Verify systems have rebooted into the fixed kernel after patch installation.
• Restrict permissions on I2C/IPMI device nodes and remove unnecessary user or service-account access to hardware-management interfaces.
• Disable or unload unnecessary IPMI/IPMB/I2C kernel modules only where validated as safe for the platform and operations.
• Monitor for kernel oops, panic, watchdog reset, I2C bus errors, or unexpected reboots on systems with exposed IPMI/I2C interfaces.
• Treat suspicious local probing of I2C/IPMI devices as potential denial-of-service preparation, especially when performed by accounts that do not normally administer hardware-management functions.