CVE-2026-23384

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23384
In the Linux kernel, the following vulnerability has been resolved: RDMA/ionic: Fix kernel stack leak in ionic_create_cq() struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udma_mask; // offset 8 - SET (resp.udma_mask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK }; rsvd[7]: 7 bytes of stack memory leaked unconditionally. cqid[2]: The loop at line 1256 iterates over udma_idx but skips indices where !(vcq->udma_mask & BIT(udma_idx)). The array has 2 entries but udma_count could be 1, meaning cqid[1] might never be written via ionic_create_cq_common(). If udma_mask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/547d0b07ad73915b323bc21f85c5d3252bebbbcf Patch
https://git.kernel.org/stable/c/a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e Patch
https://git.kernel.org/stable/c/faa72102b178c7ae6c6afea23879e7c84fc59b4e Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
History

24 Apr 2026, 18:42

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/547d0b07ad73915b323bc21f85c5d3252bebbbcf - () https://git.kernel.org/stable/c/547d0b07ad73915b323bc21f85c5d3252bebbbcf - Patch
References () https://git.kernel.org/stable/c/a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e - () https://git.kernel.org/stable/c/a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e - Patch
References () https://git.kernel.org/stable/c/faa72102b178c7ae6c6afea23879e7c84fc59b4e - () https://git.kernel.org/stable/c/faa72102b178c7ae6c6afea23879e7c84fc59b4e - Patch
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: RDMA/ionic: Corrección de fuga de pila del kernel en ionic_create_cq() struct ionic_cq_resp resp { __u32 cqid[2]; // offset 0 - PARCIALMENTE ESTABLECIDO (ver abajo) __u8 udma_mask; // offset 8 - ESTABLECIDO (resp.udma_mask = vcq-&gt;udma_mask) __u8 rsvd[7]; // offset 9 - NUNCA ESTABLECIDO &lt;- FUGA }; rsvd[7]: 7 bytes de memoria de pila fugados incondicionalmente. cqid[2]: El bucle en la línea 1256 itera sobre udma_idx pero omite los índices donde !(vcq-&gt;udma_mask &amp; BIT(udma_idx)). El array tiene 2 entradas pero udma_count podría ser 1, lo que significa que cqid[1] podría nunca ser escrito a través de ionic_create_cq_common(). Si udma_mask solo tiene el bit 0 establecido, cqid[1] (4 bytes) también se fuga. Así que potencialmente 11 bytes fugados.
CPE cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
First Time Linux
Linux linux Kernel
CWE CWE-401

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-04-24 18:42

NVD link : CVE-2026-23384

Mitre link : CVE-2026-23384

CVE.ORG link : CVE-2026-23384

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime