CVE-2026-85508

Red Hat statement

This flaw has limited practical impact for several reasons: (1) ipmi-oem is a client-side command-line tool run manually by administrators, not a listening service or daemon — exploitation requires a user to actively run the specific Dell OEM subcommand against a compromised or malicious BMC; (2) IPMI communication typically occurs over a dedicated out-of-band management network, not the general Internet; (3) Red Hat Enterprise Linux builds FreeIPMI with full hardening enabled (_hardened_build 1), including stack protector (-fstack-protector-strong), which detects stack buffer corruption and terminates the process before the return address can be hijacked — effectively limiting the impact to a client-side crash rather than code execution; (4) additional mitigations including PIE, full RELRO, and NX further hinder exploitation even if the stack canary were bypassed. Fix is available in FreeIPMI version 1.6.19.

Red Hat mitigation

Do not run ipmi-oem dell get-system-info subcommands (specifically idrac-info, cmc-info, and cmc-ipv6-info) against untrusted or unverified BMC endpoints. Restrict IPMI management network access to trusted administrators and trusted BMC controllers only. If the ipmi-oem Dell OEM subcommands are not needed, avoid using them entirely.