CVE-2026-23384

RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

published March 25, 2026

CVSS
—
EPSS
0%
Percentile
1.6
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: Fix kernel stack leak in ionic_create_cq()

struct ionic_cq_resp resp {

__u32 cqid[2]; // offset 0 - PARTIALLY SET (see below)

__u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask)

__u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK

};

rsvd[7]: 7 bytes of stack memory leaked unconditionally.

cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices

where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but

udma_count could be 1, meaning cqid[1] might never be written via

ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4

bytes) is also leaked. So potentially 11 bytes leaked.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00117 · 1.6th percentile
Published
2026-03-25T10:28Z
EPSS history
Timeline
  • 25 MAR 10:28Z
    RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
    cvelistv5