---
id: CVE-2026-81006
title: 'ipmi: Remove all sysfs files on registration failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipmi: Remove all sysfs files on registration failure

  ipmi_add_smi() creates the nr_users and nr_msgs files before trying to
  create the maintenance_mode file. If that l…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-825
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 627118470fccc61d7763aa667fcab0a9476843f6 <
    d46c97eddcbc53ca885e8bb359930c58884616ff
  - >-
    Linux >= 627118470fccc61d7763aa667fcab0a9476843f6 <
    b115b7d06f26b3f000d2afda88acb54c7a7cb2c9
  - >-
    Linux >= 627118470fccc61d7763aa667fcab0a9476843f6 <
    b6c46ab0bdee90c238e96ea4a74972118c97900d
  - Linux 6.18
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:46:31.551Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-81006'
references:
  - url: 'https://git.kernel.org/stable/c/d46c97eddcbc53ca885e8bb359930c58884616ff'
  - url: 'https://git.kernel.org/stable/c/b115b7d06f26b3f000d2afda88acb54c7a7cb2c9'
  - url: 'https://git.kernel.org/stable/c/b6c46ab0bdee90c238e96ea4a74972118c97900d'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81006.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-81006'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532053'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-81006'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-81006'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-81006.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00127
epssPercentile: 0.02376
scores:
  cna: 7.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.475Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Remove all sysfs files on registration failure

ipmi_add_smi() creates the nr_users and nr_msgs files before trying to
create the maintenance_mode file. If that last creation fails, the error
path removes only nr_users before dropping the final reference to the
interface.

Remove nr_msgs as well so no sysfs attribute embedded in the freed
interface remains registered.

## Affected

- `Linux >= 627118470fccc61d7763aa667fcab0a9476843f6 < d46c97eddcbc53ca885e8bb359930c58884616ff`
- `Linux >= 627118470fccc61d7763aa667fcab0a9476843f6 < b115b7d06f26b3f000d2afda88acb54c7a7cb2c9`
- `Linux >= 627118470fccc61d7763aa667fcab0a9476843f6 < b6c46ab0bdee90c238e96ea4a74972118c97900d`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-81006.json)