Red Hat Security Advisory

RHSA-2026:89754

freeipmi security, bug fix, and enhancement update

Released 2026-10-26 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS (v. 8) freeipmi-1.6.20-1.el8_10, freeipmi-bmc-watchdog-1.6.20-1.el8_10, freeipmi-ipmidetectd-1.6.20-1.el8_10 +1
Red Hat Enterprise Linux CRB (v. 8) freeipmi-devel-1.6.20-1.el8_10

Fixes 6 records

TI-2026-58671 CVE-2026-85509 · GHSA-3j6m-x72j-q52g

Stack-based buffer overflow in FreeIPMI

MEDIUM 49

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00493 Published 2026-09-04 Partial fix · 1.6.19 CWE-121

TI-2026-58670 CVE-2026-85508 · GHSA-g7hg-9x6v-q9jm

Stack-based buffer overflow in FreeIPMI

MEDIUM 49

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00405 Published 2026-09-04 Partial fix · 1.6.19 CWE-121

TI-2026-58669 CVE-2026-85507 · GHSA-pcp5-vqr5-x65j

Stack-based buffer overflow in FreeIPMI

MEDIUM 49

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00405 Published 2026-09-04 Partial fix · 1.6.19 CWE-121

TI-2026-58668 CVE-2026-85506 · GHSA-9xrr-58pp-j5vm

Stack-based buffer overflow in FreeIPMI

MEDIUM 49

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00493 Published 2026-09-04 Partial fix · 1.6.19 CWE-121

TI-2026-58666 CVE-2026-85504 · GHSA-pgr6-2jvx-924f

Stack-based buffer overflow in FreeIPMI

MEDIUM 49

FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00405 Published 2026-09-04 Partial fix · 1.6.19 CWE-121

TI-2026-58667 CVE-2026-85505 · GHSA-386j-5xxr-g7c7

Out-of-bounds read in FreeIPMI

LOW 39

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-20…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00353 Published 2026-09-04 Partial fix · 1.6.19 CWE-125