High severity · published May 28, 2026
CVE-2026-46177
ipmi: Add limits to event and receive message requests
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
ipmi: Add limits to event and receive message requests
The driver would just fetch events and receive messages until the
BMC said it was done. To avoid issues with BMCs that never say they are
done, add a limit of 10 fetches at a time.
In addition, an si interface has an attn state it can return from the
hardware which is supposed to cause a flag fetch to see if the driver
needs to fetch events or message or a few other things. If the attn
bit gets stuck, it's a similar problem. So allow messages in between
flag fetches so the driver itself doesn't get stuck.
This is a more general fix than the previous fix for the specific bad
BMC, but should fix the more general issue of a BMC that won't stop
saying it has data.
This has been there from the beginning of the driver. It's not a bug
per-se, but it is accounting for bugs in BMCs.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 47% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kernel · Linux
2.6.12.1 before 5.10.258; 5.11 before 5.15.209; 5.16 before 6.1.175; 6.2 before 6.6.140; 6.7 before 6.12.88; 6.13 before 6.18.30; +8 more · source: NVD
LI
Linux · Linux
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 112df8e631636cafda64dcee4561daf09ce74a4a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 304b56883b7eff73eb606c35d062c8101aaf5471; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 9059dc94421e1d4f8e5844204608b37ebfddb3da; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 67c44e0deba936d5edaebea356b4589eb43acb5c; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e20212b431bef217d3886b86bbc90cc3ed00de68; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 3d37d2165df9504ea99d9e6181552dc4d2d1ab37; +3 more · source: vendor
SS
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem · Siemens
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-46177
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-46177
Patch
https://git.kernel.org/stable/c/112df8e631636cafda64dcee4561daf09ce74a4a
Patch
https://git.kernel.org/stable/c/304b56883b7eff73eb606c35d062c8101aaf5471
Patch
https://git.kernel.org/stable/c/3d37d2165df9504ea99d9e6181552dc4d2d1ab37
Patch
https://git.kernel.org/stable/c/67c44e0deba936d5edaebea356b4589eb43acb5c
Patch
https://git.kernel.org/stable/c/9059dc94421e1d4f8e5844204608b37ebfddb3da
Patch
https://git.kernel.org/stable/c/c024167fb00489baee08c72182ca2e7dc5fb9f20
More from Kernel
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
8.8
CVE-2013-6282
Linux Kernel Improper Input Validation Vulnerability
8.4
CVE-2022-0185
Linux Kernel Heap-Based Buffer Overflow Vulnerability
8.4
CVE-2013-2094
Linux Kernel Privilege Escalation Vulnerability
