CVE-2026-23322
Published: 25 March 2026
Summary
CVE-2026-23322 is a high-severity Use After Free (CWE-416) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 4.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-11 (Error Handling) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23322 is a use-after-free and list corruption vulnerability in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem. Published on 2026-03-25, it arises in the smi_work() function when the SMI sender returns an error. In this scenario, an error response is delivered, but the code jumps to restart without clearing intf->curr_msg, causing the same message to be reprocessed. This leads to deliver_err_response() queuing the same recv_msg twice on the user_msgs list, resulting in list_add corruption. Subsequent operations trigger use-after-free when the memory is reused and freed, potentially culminating in a NULL pointer dereference on recv_msg->done. The issue is classified under CWE-416 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Exploitation involves triggering repeated sender failures on the same IPMI message, leading to kernel list corruption and use-after-free. This can enable high-impact confidentiality, integrity, and availability violations, such as arbitrary kernel memory corruption, code execution, or system crashes.
Kernel patches address the issue by freeing the message and setting it to NULL upon send error, while ensuring newmsg is always freed to prevent leaks. Relevant fixes are in the following stable commits: https://git.kernel.org/stable/c/594c11d0e1d445f580898a2b8c850f2e3f099368, https://git.kernel.org/stable/c/65ff5d1e4410df05edfbeb7bf2d62f7681ce1d53, and https://git.kernel.org/stable/c/c08ec55617cb9674a060a3392ea08391ab2a4f74. Security practitioners should update affected Linux kernels to versions incorporating these patches.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-15274
Vulnerability details
In the Linux kernel, the following vulnerability has been resolved: ipmi: Fix use-after-free and list corruption on sender error The analysis from Breno: When the SMI sender returns an error, smi_work() delivers an error response but then jumps back to…
more
restart without cleaning up properly: 1. intf->curr_msg is not cleared, so no new message is pulled 2. newmsg still points to the message, causing sender() to be called again with the same message 3. If sender() fails again, deliver_err_response() is called with the same recv_msg that was already queued for delivery This causes list_add corruption ("list_add double add") because the recv_msg is added to the user_msgs list twice. Subsequently, the corrupted list leads to use-after-free when the memory is freed and reused, and eventually a NULL pointer dereference when accessing recv_msg->done. The buggy sequence: sender() fails -> deliver_err_response(recv_msg) // recv_msg queued for delivery -> goto restart // curr_msg not cleared! sender() fails again (same message!) -> deliver_err_response(recv_msg) // tries to queue same recv_msg -> LIST CORRUPTION Fix this by freeing the message and setting it to NULL on a send error. Also, always free the newmsg on a send error, otherwise it will leak.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local kernel UAF/list corruption enables direct exploitation for privilege escalation to root via arbitrary code execution in kernel context.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation through kernel patching directly eliminates the IPMI use-after-free and list corruption vulnerability in CVE-2026-23322.
Secure error handling prevents improper cleanup on SMI sender failures, avoiding repeated message processing and subsequent list corruption in the IPMI subsystem.
Kernel memory protections such as KASLR and SMEP mitigate exploitation of the use-after-free by limiting arbitrary memory access and code execution.