Medium [CVE-2026-85505] Denial of Service via stack-based buffer over-read in ipmi-oem
This medium-severity Red Hat Linux advisory covers CVE-2026-85505 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
A stack-based out-of-bounds read vulnerability was found in the FreeIPMI ipmi-oem utility. When processing an abnormally short response from a Baseboard Management Controller (BMC), the application over-reads the buffer.
A malicious BMC could exploit this to crash the client application (Denial of Service) or potentially leak stack memory. Red Hat compiler safeguards further restrict the impact primarily to a process crash.
If a BMC returns an unexpectedly truncated System Event Log (SEL) response, the client fails to validate the data length before reading. This causes the application to read past the allocated stack buffer boundaries, leading to a crash or potential memory disclosure.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-125.
Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: freeipmi.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 59 minutes ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 59 minutes ago·verify at source
Mitigation checklist
- Restrict IPMI and BMC access to a dedicated, trusted management network so ipmi-oem cannot reach untrusted or compromised Fujitsu controllers. Until a fixed freeipmi package is installed, do not run ipmi-oem fujitsu get-sel-entry-long-text against untrusted BMCs. If that OEM SEL long-text query is not required, do not use ipmi-oem against remote management controllers.
Official advisory · high-confidence parse· fetched 59 minutes ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.