The Linux kernel IPMI subsystem's ipmi_add_smi() function creates sysfs files nr_users and nr_msgs before attempting to create maintenance_mode. If creation of maintenance_mode fails, the error handling path only removed nr_users before releasing the interface reference, leaving nr_msgs registered and embedded in a freed interface. The fix removes nr_msgs as well to prevent stale sysfs attributes from remaining after registration failure.

The vulnerability could lead to stale sysfs attributes referencing freed kernel memory, which may cause undefined behavior or kernel instability. No direct exploit or active exploitation is reported.

A fix has been applied to the Linux kernel to remove all sysfs files on registration failure in the IPMI subsystem. Users should update to a kernel version that includes this fix. No additional mitigation is indicated.