# RHSA-2026:89905: freeipmi security update

RHSA-2026:89905, released September 4, 2026, fixes 6 CVEs in freeipmi (version 1.6.20-1.el10_2). None of them is reported as exploited. Patch Radar priority: Urgent.

- Web page: https://patchblox.com/security/fix/linux/rhsa-2026-89905
- Platform: Linux
- Released: Sep 4, 2026
- Priority: Urgent (Closes CVE-2026-85509, rated Critical)
- CVEs: 6, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://access.redhat.com/errata/RHSA-2026:89905

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [freeipmi](https://patchblox.com/security/data/product/linux/freeipmi.md) | RHEL 10 | 1.6.20-1.el10_2 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-85506](https://patchblox.com/security/data/cve/CVE-2026-85506.md) | Urgent | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-info subcommand to dell get-system-info). | 9.8 | 0.0049 |  |
| [CVE-2026-85509](https://patchblox.com/security/data/cve/CVE-2026-85509.md) | Urgent | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than requested. | 9.8 | 0.0049 |  |
| [CVE-2026-85504](https://patchblox.com/security/data/cve/CVE-2026-85504.md) | Urgent | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses. | 9.8 | 0.0041 |  |
| [CVE-2026-85507](https://patchblox.com/security/data/cve/CVE-2026-85507.md) | Urgent | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_info in ipmi-oem/ipmi-oem-dell.c (cmc-info subcommand to dell get-system-info). | 9.8 | 0.0041 |  |
| [CVE-2026-85508](https://patchblox.com/security/data/cve/CVE-2026-85508.md) | Urgent | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (cmc-ipv6-info subcommand to dell get-system-info). | 9.8 | 0.0041 |  |
| [CVE-2026-85505](https://patchblox.com/security/data/cve/CVE-2026-85505.md) | High | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer over-read in ipmi_oem_fujitsu_get_sel_entry_long_text in ipmi-oem/ipmi-oem-fujitsu.c when a BMC provides a short response, a different vulnerability than CVE-2026-50031 (which has different affected versions). | 7.5 | 0.0035 |  |

---

Data as of 2026-11-07T12:40:37Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo