CVE-2026-72042

CVE-2026-72042 is a double-refcount-drop in the IPMI event delivery rollback path. The bug: when event delivery fails, the error cleanup calls ipmi_free_recv_msg() (which already releases the message's reference) followed by an explicit put_user() — the latter drops a reference that was never held, causing the user object to be freed prematurely while still referenced by intf->users. The fix is simple: remove the extraneous put_user(). But the vulnerability isn't merely a typo — it's a structural failure of ownership semantics in the rollback path. The critical exposure is blast radius, not the double-drop itself. Once the user object is freed, it remains on the intf->users list. Every subsequent event delivery attempt on that interface will either hit a use-after-free or trigger a refcount_t zero-addition fault. The corruption propagates: the poisoned user object corrupts the entire event delivery subsystem for that interface until the interface is unregistered. The deeper pattern: rollback paths have no structural defense against semantic drift. ipmi_alloc_recv_msg() takes a temporary reference and ipmi_free_recv_msg() releases it — but the error handler also contained an explicit put_user(). This dual-ownership model requires developers to track two separate reference-granting mechanisms across happy and failure paths simultaneously. The dead put_user() persisted not because it was invisible, but because it looked protective: list_del() + ipmi_free_recv_msg() + put_user() reads like thorough cleanup, creating an illusion of completeness that discourages scrutiny. For defenders: prioritize identifying systems with active IPMI interfaces, particularly those where event daemon logging is enabled. The vulnerability triggers on event delivery failure — so systems with IPMI event generation (SEL logs, sensor threshold alerts) are the exposure surface. Check for refcount_t warnings in kernel logs preceding any IPMI-related crashes. The fix removes one line; the detection challenge is the downstream corruption, which may manifest as seemingly unrelated use-after-free errors in event delivery code paths.

Reviewed through automated stages and approved by a human before publication.