CVE-2026-23335: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23335 is a kernel stack memory disclosure vulnerability in the Linux kernel's RDMA/irdma driver, specifically within the irdma_create_user_ah() function. The irdma_create_ah_resp structure contains a 4-byte reserved field (rsvd[4]) that is never zeroed before being passed to user space via ib_respond_udata(), unconditionally leaking uninitialized kernel stack memory to unprivileged local users. Affected Linux kernel versions span from 5.14 through 6.19.6 and 7.0-rc1 through 7.0-rc7, across multiple stable branches. It was published on March 25, 2026, with a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is classified as CWE-908 (Use of Uninitialized Resource) and CWE-401 (Missing Release of Memory after Effective Lifetime). In irdma_create_user_ah(), only the ah_id field of the irdma_create_ah_resp structure is assigned (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) before the structure is copied to user space; the trailing rsvd[4] bytes remain as whatever was on the kernel stack at that memory location. Because the structure is stack-allocated and not zero-initialized, these 4 bytes are unconditionally disclosed to any local user who invokes the RDMA address handle creation interface. The fix requires zero-initializing the response structure (e.g., using memset or designated initializers) before populating fields (Red Hat Bugzilla, Feedly).

A local user with low privileges can read 4 bytes of uninitialized kernel stack memory per invocation of the RDMA address handle creation interface. While the direct data exposure is small, the leaked bytes may contain sensitive kernel data such as cryptographic material, kernel pointers, or other confidential values. Critically, exposed kernel pointers can be used to defeat ASLR (Address Space Layout Randomization), potentially enabling further kernel exploitation and privilege escalation on systems with RDMA/irdma hardware (Feedly).

Upgrade to a patched Linux kernel version for the applicable stable branch: 5.15.203 (for 5.14.1–5.15.202), 6.1.167 (for 5.16–6.1.166), 6.6.130 (for 6.2–6.6.129), 6.12.77 (for 6.7–6.12.76), 6.18.17 (for 6.13–6.18.16), 6.19.7 (for 6.19–6.19.6), or 7.0-rc2 or later for 7.0 release candidates. Multiple stable kernel git commits are available addressing this issue (Red Hat Bugzilla, Feedly). As a temporary workaround on systems where RDMA is not required, unloading or blacklisting the irdma kernel module will eliminate the attack surface. Distribution-specific updates are available from Red Hat, SUSE, Debian, Amazon Linux, and openSUSE (SUSE Advisory, Amazon Linux).