Linux kernel RDMA/ionic stack leak in ionic_create_cq()
CVE-2026-23384 Published on March 25, 2026
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ionic: Fix kernel stack leak in ionic_create_cq()
struct ionic_cq_resp resp {
__u32 cqid[2]; // offset 0 - PARTIALLY SET (see below)
__u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask)
__u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK
};
rsvd[7]: 7 bytes of stack memory leaked unconditionally.
cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices
where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but
udma_count could be 1, meaning cqid[1] might never be written via
ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4
bytes) is also leaked. So potentially 11 bytes leaked.
Products Associated with CVE-2026-23384
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version e8521822c733c6deab0f339843cd37cd62c12795 and below a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e is affected.
- Version e8521822c733c6deab0f339843cd37cd62c12795 and below 547d0b07ad73915b323bc21f85c5d3252bebbbcf is affected.
- Version e8521822c733c6deab0f339843cd37cd62c12795 and below faa72102b178c7ae6c6afea23879e7c84fc59b4e is affected.
- Version 6.18 is affected.
- Before 6.18 is unaffected.
- Version 6.18.17, <= 6.18.* is unaffected.
- Version 6.19.7, <= 6.19.* is unaffected.
- Version 7.0-rc2, <= * is unaffected.