CVE-2026-72042

In the Linux kernel, the following vulnerability has been resolved:

ipmi: Fix user refcount underflow in event delivery

ipmi_alloc_recv_msg(user) takes the temporary user reference owned by the

receive message, and ipmi_free_recv_msg() drops it again. If event delivery

fails after allocating receive messages for earlier users,

handle_read_event_rsp() rolls those messages back with

ipmi_free_recv_msg().

That rollback path still drops user->refcount explicitly after freeing each

message. The extra put can free a user that remains linked on intf->users,

so later event delivery may dereference a freed user or trip refcount_t's

addition-on-zero warning when ipmi_alloc_recv_msg() tries to acquire

another reference.

Remove the stale explicit put and the now-dead user assignment. Keep the

list_del() and ipmi_free_recv_msg() calls; they are the required rollback

operations.