The vulnerability (CVE-2026-89486) in the Linux kernel IPMI subsystem stems from a missing synchronize_rcu() call in the _ipmi_destroy_user() function. A previous commit removed synchronize_rcu() between unlinking command receivers from the intf->cmd_rcvrs list and freeing them, mistakenly assuming it was unnecessary. However, the cmd_rcvrs list is still traversed under plain RCU, and readers may hold pointers to cmd_rcvr structures. Without the grace period provided by synchronize_rcu(), _ipmi_destroy_user() can free a cmd_rcvr while a reader still accesses it, causing a use-after-free vulnerability. The fix restores the synchronize_rcu() call to ensure safe memory reclamation.

This vulnerability can lead to use-after-free conditions in the Linux kernel IPMI subsystem, potentially causing kernel crashes or undefined behavior if a freed cmd_rcvr structure is accessed. No known exploits in the wild have been reported. The impact is limited to systems using the affected IPMI code paths in the Linux kernel.

A fix is available that restores the synchronize_rcu() call before freeing cmd_rcvr structures in _ipmi_destroy_user(). Users should apply the official Linux kernel patches that address this issue. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation.