Vulnerability feed

Executive summary

Red Hat has released a security update for the freeipmi package on Red Hat Enterprise Linux 8, which provides tools for managing servers through the Intelligent Platform Management Interface. The advisory rates the update as Moderate severity and fixes six vulnerabilities that can lead to arbitrary code execution or denial of service. The vendor recommends applying the updated freeipmi packages as described in its linked guidance.

Technical summary

The advisory describes stack-based buffer overflows and buffer over-reads in freeipmi, including in the ipmi-oem component, and one flaw triggered by malformed Fujitsu System Event Log responses. The impact listed includes arbitrary code execution for most issues and denial of service for CVE-2026-85505. Affected packages are freeipmi versions before 1.6.20-1.el8_10, and the fixed version is freeipmi-1.6.20-1.el8_10 across the listed RHEL 8 and CodeReady Linux Builder channels. The advisory does not state attack vector, required preconditions, or any workaround. It does not state whether exploitation in the wild has occurred, and it does not give a CVSS score in the text, referring readers to the CVE pages instead. Detection guidance is not stated beyond the update instructions at the linked Red Hat article.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from access.redhat.com/errata/RHSA-2026:89754

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

High

Privileges required

None

User interaction

Required

Scope

Unchanged

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affects

Red HatFreeIPMIRed Hat Enterprise LinuxRed Hat Enterprise Linux for x86_64 8Red Hat Enterprise Linux for IBM z Systems 8Red Hat Enterprise Linux for Power, little endian 8Red Hat Enterprise Linux for ARM 64 8Red Hat CodeReady Linux BuilderFreeIPMIRed Hat freeipmi