CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Fix kernel stack leak in irdmacreateuserah()
struct irdmacreateahresp { // 8 bytes, no padding u32 ahid; // offset 0 - SET (uresp.ahid = ah->scah.ahinfo.ahidx) u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK };
rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ahid is assigned before ibrespondudata().
The reserved members of the structure were not zeroed.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the information leak?
A local attacker with low privileges can trigger it. The vulnerable path is irdma_create_user_ah(), so exposure is limited to systems where the irdma RDMA driver and its user-address-handle creation functionality are available to that user.
What information is disclosed?
The response structure returns four reserved bytes that were never initialized. Those bytes contain kernel stack memory, while the ah_id field is explicitly set.
Is user interaction or remote network access required?
No user interaction is required. The supplied CVSS vector identifies the attack vector as local, so this is not described as remotely exploitable over the network.
What can be done if an update cannot be applied immediately?
Restrict untrusted local users from accessing the affected RDMA/irdma functionality. This reduces the ability of low-privileged local users to invoke the vulnerable user address-handle creation path.