CVE-2026-72040

In the Linux kernel, the following vulnerability has been resolved:

ipmi: fix refcount leak in i_ipmi_request()

When a caller provides a `supplied_recv` message to i_ipmi_request(),

the function increments the user's `nr_msgs` reference count. If an

error occurs later, the out_err cleanup path only frees the recv_msg

if the function allocated it itself (i.e., !supplied_recv). In the

supplied_recv case the cleanup is skipped, leaving the reference count

elevated. The caller ipmi_request_supply_msgs() does not release the

supplied_recv on error, so the reference is permanently leaked.

Fix this by explicitly reverting the reference count operations when a

supplied recv_msg with a valid user pointer is present in the error

path: decrement nr_msgs and drop the user's kref.