RHSA-2026:89905MediumCVSS 7.5

Red Hat Security Advisory: freeipmi security, bug fix, and enhancement update

Published
October 26, 2026
Last Modified
October 26, 2026

🔗 CVE IDs covered (6)

CVE-2026-85504 →CVE-2026-85505 →CVE-2026-85506 →CVE-2026-85507 →CVE-2026-85508 →CVE-2026-85509 →

📋 Description

CVE-2026-85504 — FreeIPMI: FreeIPMI: Arbitrary code execution via malformed Fujitsu System Event Log responses CVE-2026-85505 — FreeIPMI: FreeIPMI: Denial of Service via stack-based buffer over-read in ipmi-oem CVE-2026-85506 — FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow in ipmi-oem CVE-2026-85507 — FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow CVE-2026-85508 — freeipmi: FreeIPMI: stack-based buffer overflow in ipmi-oem Dell system info handler CVE-2026-85509 — FreeIPMI: FreeIPMI: Arbitrary code execution via stack-based buffer overflow

🎯 Affected products63

  • Red Hat Enterprise Linux AppStream (v. 10)
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-0:1.6.20-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-0:1.6.20-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-0:1.6.20-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-0:1.6.20-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-0:1.6.20-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-bmc-watchdog-debuginfo-0:1.6.20-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.s390x as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-debuginfo-0:1.6.20-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-debugsource-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • freeipmi-debugsource-0:1.6.20-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)
  • freeipmi-debugsource-0:1.6.20-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)
  • +33 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Restrict IPMI and BMC access to a dedicated, trusted management network so FreeIPMI SEL tools cannot reach untrusted or compromised Fujitsu controllers. Please do not run ipmi-sel with OEM interpretation (--interpret-oem-data) against untrusted BMCs, and do not enable interpret-oem-data in ipmiseld for those hosts. If Fujitsu OEM long-text SEL decoding is not required, leave that option off. Workaround: Restrict IPMI and BMC access to a dedicated, trusted management network so ipmi-oem cannot reach untrusted or compromised Fujitsu controllers. Until a fixed freeipmi package is installed, do not run ipmi-oem fujitsu get-sel-entry-long-text against untrusted BMCs. If that OEM SEL long-text query is not required, do not use ipmi-oem against remote management controllers. Workaround: To mitigate this vulnerability, implement robust boundary checks before copying data to ensure the input size does not exceed the allocated stack buffer capacity. Developers should replace unsafe, unbounded memory functions (like strcpy or sprintf) with safe, length-restricted alternatives (such as strncpy or snprintf). Furthermore, deploying the application in environments that enforce compiler-based protections like stack canaries and Address Space Layout Randomization (ASLR) will prevent successful code execution Workaround: Restrict IPMI and BMC access to a dedicated, trusted management network so ipmi-oem cannot reach untrusted or compromised controllers. Please do not run ipmi-oem dell get-system-info cmc-info against untrusted BMCs. If that Dell CMC query is not required, do not use ipmi-oem against remote management controllers. Workaround: Do not run ipmi-oem dell get-system-info subcommands (specifically idrac-info, cmc-info, and cmc-ipv6-info) against untrusted or unverified BMC endpoints. Restrict IPMI management network access to trusted administrators and trusted BMC controllers only. If the ipmi-oem Dell OEM subcommands are not needed, avoid using them entirely. Workaround: Restrict IPMI and BMC access to a dedicated, trusted management network so FreeIPMI clients cannot reach untrusted or compromised controllers. Please do not run ipmi-fru or bmc-device --read-fru against untrusted BMCs. If FRU inventory queries are not required, do not use those tools (or other libfreeipmi FRU callers) against remote management controllers.

🔗 References (9)