{"apiVersion":"1.0","identifier":"CVE-2026-72040","description":"In the Linux kernel, the following vulnerability has been resolved: ipmi: fix refcount leak in i_ipmi_request() When a caller provides a `supplied_recv` message to i_ipmi_request(), the function increments the user-s `nr_msgs` reference count. If an error occurs later, the out_err cleanup path only frees the recv_msg if the function allocated it itself (i.e., !supplied_recv). In the supplied_recv case the cleanup is skipped, leaving the reference count elevated. The caller ipmi_request_supply_msgs() does not release the supplied_recv on error, so the reference is permanently leaked. Fix this by explicitly reverting the reference count operations when a supplied recv_msg with a valid user pointer is present in the error path: decrement nr_msgs and drop the user-s kref.","publishedAt":"2026-08-15T06:21:13","lastModifiedAt":"2026-08-23T13:16:37","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72040","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00206,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72040","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72040","en":"https://www.redsauce.net/en/cves/CVE-2026-72040","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72040","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72040","de":"https://www.redsauce.net/de/cves/CVE-2026-72040","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72040","el":"https://www.redsauce.net/el/cves/CVE-2026-72040"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72040"}}