{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipmi: si: Fix NULL pointer dereference after failed registration  try_smi_init() allocates new_smi-\u003esi_sm and later calls ipmi_register_smi_mod(), which maps to ipmi_add_smi().  During ipmi_add_smi(), the upper IPMI message handler obtains the initial BMC device information through __bmc_get_device_id(). This can fail if the BMC does not return a successful response to the Get Device ID command.  When the BMC returns a nonzero completion code, the device-id helper retries the command and eventually returns -EIO if the device ID still cannot be fetched.  On this failure path, ipmi_add_smi() logs \"Unable to get the device id\" and goes to out_err_started, where it invokes the lower driver's shutdown callback. try_smi_init() then logs the returned registration failure:   ipmi_si IPI0001:00: IPMI message handler: Unable to get the device id: -5  ipmi_si IPI0001:00: Unable to register device: error -5  For ipmi_si, the shutdown callback is shutdown_smi(), which cleans up the SI state machine data, frees smi_info-\u003esi_sm, and sets smi_info-\u003esi_sm and smi_info-\u003eintf to NULL.  However, intf-\u003ein_shutdown is not set on this failed-registration rollback path. Therefore, the asynchronous redo_bmc_reg work item can still retry BMC device-id probing after the lower driver has already cleared its SI state machine data. In the observed case, that retry path reached start_next_msg(), which passed the NULL smi_info-\u003esi_sm pointer to the selected KCS state machine handler:  BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 Workqueue: events redo_bmc_reg [ipmi_msghandler] RIP: start_kcs_transaction+0x2c/0x190 [ipmi_si] Call Trace:  start_next_msg+0x50/0x80 [ipmi_si]  check_start_timer_thread.part.9+0x3b/0x50 [ipmi_si]  sender+0x69/0x80 [ipmi_si]  i_ipmi_request+0x2ac/0x9d0 [ipmi_msghandler]  __get_device_id.isra.29+0xaa/0x180 [ipmi_msghandler]  __bmc_get_device_id+0xef/0x950 [ipmi_msghandler]  redo_bmc_reg+0x52/0x60 [ipmi_msghandler]  process_one_work+0x1a7/0x360  Set intf-\u003ein_shutdown on the out_err_started path before invoking the lower driver's shutdown callback. This prevents later redo_bmc_reg retries from using an interface whose lower driver state has been cleaned up, and applies the same shutdown state to other IPMI interfaces as well.",
  "id": "DEBIAN-CVE-2026-81005",
  "modified": "2026-09-23T03:47:34.565582741Z",
  "published": "2026-09-11T20:19:09.173Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-81005"
    }
  ],
  "upstream": [
    "CVE-2026-81005"
  ]
}