CVE-2026-23384: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-23384 is a kernel stack memory leak vulnerability in the Linux kernel's RDMA/ionic driver, specifically within the ionic_create_cq() function. The flaw causes uninitialized kernel stack memory to be returned to userspace, exposing up to 11 bytes of sensitive data. Affected versions include Linux kernel 6.18.0–6.18.16, 6.19.0–6.19.6, and 7.0-rc1 through 7.0-rc7. It was disclosed on March 25, 2026, and carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Red Hat Bugzilla).

The root cause is the use of uninitialized stack memory (CWE-908) in the ionic_cq_resp structure within ionic_create_cq(). Specifically, the rsvd[7] field (7 bytes at offset 9) is never initialized before the structure is returned to userspace, constituting an unconditional leak. Additionally, the cqid[2] array (offset 0) is only partially populated: the loop iterating over udma_idx skips indices where the corresponding bit in vcq->udma_mask is not set, so if udma_mask has only bit 0 set, cqid[1] (4 bytes) is also never written, resulting in up to 11 bytes of leaked stack memory in total (Red Hat Bugzilla, Red Hat CVE). Exploitation requires local access with low privileges and no user interaction.

A local attacker with low privileges can trigger ionic_create_cq() to read up to 11 bytes of uninitialized kernel stack memory returned to userspace. The primary risk is information disclosure: leaked kernel addresses can be used to defeat Kernel Address Space Layout Randomization (KASLR), which may facilitate chaining with other vulnerabilities to achieve privilege escalation. While the direct impact is limited to information disclosure (no direct integrity or availability impact), the KASLR bypass capability makes this vulnerability a meaningful enabler for more severe exploit chains on systems using RDMA/ionic hardware (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.017% (0.000170), reflecting a very low probability of exploitation in the near term. Exploitation is constrained to local access with low privileges, limiting the attack surface to users or processes with the ability to invoke RDMA/ionic CQ creation on affected systems.

Update to a patched Linux kernel version: 6.18.17 or later, 6.19.7 or later, or 7.0-rc2 or later. Patch commits are available via the upstream kernel repository (kernel patch 1, kernel patch 2, kernel patch 3). As a temporary workaround where patching is not immediately possible, restricting local user access to RDMA/ionic devices (e.g., via device permissions or disabling the ionic RDMA driver module) can reduce exposure. Organizations using Cisco Pensando/ionic RDMA hardware should prioritize this update, particularly on multi-tenant or shared systems.