Memory Corruption Vulnerability in Linux Kernel ipmi_create_user() Function

CVE-2025-38456

What is CVE-2025-38456?

A memory corruption vulnerability exists in the Linux kernel's ipmi_create_user() function that can be exploited by calling atomic_dec() on an invalid pointer. This occurs when the program fails to properly find the corresponding 'intf->intf_num' leading to inadvertent decrement of the user count on a non-existent interface. Ensuring correct handling in the shutdown path and verifying interface validity prior to operations is crucial to mitigating potential instances of memory corruption in affected systems.

References