CVE-2026-23289: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23289 is a resource leak vulnerability in the Linux kernel's InfiniBand IB/mthca driver, caused by a missing mthca_unmap_user_db() call on the failure path of mthca_create_srq(). It was published on March 25, 2026, and affects Linux kernel versions from 2.6.14 through multiple stable branches, with fixed versions including 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. Microsoft's Azure Linux kernel (azl3_kernel_6.6.126.1-1) is also listed as affected. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). When the mthca_create_srq() system call fails partway through execution, the code omits the required mthca_unmap_user_db() cleanup call, leaving a user database mapping unreleased in kernel memory. This is a locally exploitable flaw — a low-privileged local user can trigger the failure path repeatedly via crafted system calls to the mthca InfiniBand driver, causing incremental kernel memory exhaustion. Patches addressing this issue are available in the upstream Linux kernel stable tree across multiple branches (Red Hat Advisory, Kernel Patch).

Successful exploitation primarily impacts system availability: a local low-privileged user can repeatedly trigger the resource leak to exhaust kernel memory, potentially causing denial of service conditions on the affected host. There is no confidentiality or integrity impact assessed in the CVSS scoring, though the unfreed mapping could theoretically expose sensitive kernel memory in edge cases. The scope is limited to the local system; lateral movement is not a direct consequence of this vulnerability (Red Hat Advisory, Feedly).

Apply the upstream kernel patches that add the missing mthca_unmap_user_db() call to the mthca_create_srq() failure path. Fixed kernel versions include: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, and 7.0-rc2. Distribution-specific updates are available from Red Hat, Microsoft (Azure Linux), and Debian (DSA-6238, DSA-6243, DLA-4561). As a workaround, restrict access to InfiniBand/mthca device operations to trusted users only, and monitor kernel memory usage for signs of resource exhaustion (Red Hat Advisory, Microsoft Advisory).