SUSE CVE-2026-85505

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

UBUNTU-CVE-2026-85505

ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmioemfujitsugetselentrylongtext in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 which has different affected versions...

CVE-2026-85509

FreeIPMI before 1.6.19 has a stack-based buffer overflow in readfrudata in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested...

EUVD-2026-70887

FreeIPMI before 1.6.19 has a stack-based buffer overflow in readfrudata in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested...

CVE-2026-85509

FreeIPMI before 1.6.19 has a stack-based buffer overflow in readfrudata in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested...

CVE-2026-85509

FreeIPMI before 1.6.19 contains a stack-based buffer overflow in the _read_fru_data function within libfreeipmi/fru/ipmi-fru.c, triggered when a BMC returns more bytes than requested . The vulnerability is rated CVSS 9.8 (Critical) with a network attack vector, low complexity, and no required pri...

CVE-2026-85505

FreeIPMI before 1.6.19 contains a stack-based buffer over-read in the ipmi-oem component, specifically in the function ipmi_oem_fujitsu_get_sel_entry_long_text (file ipmi-oem/ipmi-oem-fujitsu.c). The flaw is triggered when a Baseboard Management Controller (BMC) provides a short response , allowi...

CVE-2026-85509

FreeIPMI before 1.6.19 has a stack-based buffer overflow in readfrudata in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested...

AZL-89027 CVE-2026-46128 affecting package kernel for versions less than 6.6.141.1-1

In the Linux kernel, the following vulnerability has been resolved: ipmi: Check event message buffer response for bad data The event message buffer response data size got checked later when processing, but check it right after the response comes back. It appears some BMCs may return an empty...