CVE-2026-23335: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-25 · updated 2026-10-15
Weakness: CWE-401

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK }; rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata(). The reserved members of the structure were not zeroed.

Affected products

Linux kernel: from 5.14.1 before 5.15.203; from 5.16 before 6.1.167; from 6.2 before 6.6.130; from 6.7 before 6.12.77; from 6.13 before 6.18.17; from 6.19 before 6.19.7 — fixed in 5.15.203, 6.1.167, 6.12.77, 6.18.17, 6.19.7, 6.6.130

How to fix

Upgrade to a fixed version: Linux kernel 5.15.203, 6.1.167, 6.12.77, 6.18.17. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23335 or the next vulnerability affects your stack