CVE-2026-23335

RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah()

struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK };

rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata().

The reserved members of the structure were not zeroed.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 1f70df004fdd944653013ccc2e1dfd472a693b46Affected b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 14b47c07c69930254f549a17ee245c80a65b1609Affected b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 1b1fac4c7a3ab7f52e9cfb91e5c91216646ca4d8Affected b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 2fd37450d271d74b3847baed284f9cfdf198c6f8Affected b48c24c2d710cf34810c555dcef883a3d35a9c08 to before cfe962216c164fe2b1c1fb6ac925a7413f5abc84Affected b48c24c2d710cf34810c555dcef883a3d35a9c08 to before c9bd0007c4bdb7806bbd323287e50f9cf467c51aAffected b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 74586c6da9ea222a61c98394f2fc0a604748438cAffected
LinuxLinux	5.14Affected before 5.14Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 1f70df004fdd944653013ccc2e1dfd472a693b46Affected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 14b47c07c69930254f549a17ee245c80a65b1609Affected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 1b1fac4c7a3ab7f52e9cfb91e5c91216646ca4d8Affected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 2fd37450d271d74b3847baed284f9cfdf198c6f8Affected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to before cfe962216c164fe2b1c1fb6ac925a7413f5abc84Affected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to before c9bd0007c4bdb7806bbd323287e50f9cf467c51aAffected
b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 74586c6da9ea222a61c98394f2fc0a604748438cAffected

LinuxLinux

5.14Affected
before 5.14Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.