CVE-2026-23335: Linux Kernel Information Disclosure Flaw

CVE-2026-23335 Overview

CVE-2026-23335 is a kernel stack information disclosure vulnerability in the Linux kernel's Intel Ethernet Protocol Driver for RDMA (irdma). The flaw resides in irdma_create_user_ah(), which populates a struct irdma_create_ah_resp response object and returns it to userspace without zeroing the rsvd[4] reserved field. As a result, four bytes of uninitialized kernel stack memory leak to any local user that can invoke the RDMA create-AH (Address Handle) uverbs call. The issue is tracked as [CWE-401] and affects multiple stable Linux kernel branches up to release candidates of 7.0.

Critical Impact
Local users with access to the RDMA subsystem can repeatedly trigger the leak to harvest kernel stack contents, potentially exposing pointers, secrets, or state useful for bypassing KASLR.

Affected Products

Linux kernel — multiple stable branches
Linux kernel 5.14
Linux kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

2026-03-25 - CVE-2026-23335 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-23335

Vulnerability Analysis

The irdma driver implements RDMA Address Handle creation through irdma_create_user_ah(). On success, the driver returns a response structure to userspace via ib_copy_to_udata() (referenced in the patch description as ib_respond_udata()). The response structure is defined as follows:

struct irdma_create_ah_resp {  // 8 bytes, no padding
    __u32 ah_id;               // offset 0 - SET
    __u8  rsvd[4];             // offset 4 - NEVER SET (LEAK)
};

Only the ah_id member is assigned before the response is copied out. The four reserved bytes are left untouched on the kernel stack and inherit whatever transient data the calling thread previously stored at that offset. Because the structure is allocated on the stack, the leaked bytes can include fragments of saved registers, function pointers, or local variables from earlier kernel calls.

Root Cause

The defect is a classic missing initialization bug categorized under [CWE-401]. The reserved padding field exists for ABI stability but is never zeroed via memset() or designated initializer syntax (= {}). When the kernel hands the structure back to userspace, the uninitialized bytes are exposed verbatim. The upstream fix initializes the response structure to zero before any field assignments.

Attack Vector

Exploitation requires local access and the ability to open an RDMA verbs device node (typically /dev/infiniband/uverbsN) exposed by an irdma-managed Intel Ethernet adapter. An attacker with low privileges issues the create-AH uverbs command, reads back the response, and extracts the trailing four bytes. Repeated invocations produce a stream of kernel stack disclosures that an attacker can correlate to defeat Kernel Address Space Layout Randomization (KASLR) or stage a follow-on memory corruption exploit. The CVSS vector indicates a local attack with high availability impact rather than confidentiality impact, reflecting the upstream scoring choice; the practical risk is information disclosure useful as a primitive in chained attacks.

No public proof-of-concept code is referenced in the advisory, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-23335

Indicators of Compromise

Unprivileged or service accounts opening /dev/infiniband/uverbs* device nodes on systems with Intel irdma-managed NICs.
High-frequency IB_USER_VERBS_CMD_CREATE_AH calls originating from non-RDMA workloads.
Processes loading the irdma module on hosts without legitimate RDMA applications.

Detection Strategies

Audit kernel version banners (uname -r) and compare against the fixed commit hashes listed in the kernel.org references to identify unpatched hosts at scale.
Enable Linux audit rules on open() syscalls targeting /dev/infiniband/ paths and forward events to a centralized analytics pipeline.
Monitor process telemetry for unexpected linkage to libibverbs or invocation of ibv_create_ah from non-RDMA application binaries.

Monitoring Recommendations

Track loaded kernel modules across the fleet and alert when irdma appears on hosts without an RDMA workload baseline.
Correlate local privilege escalation attempts with prior access to RDMA uverbs interfaces to surface multi-stage exploitation.
Review SIEM telemetry for repeated short-lived processes that open RDMA devices, a pattern consistent with iterative information-leak harvesting.

How to Mitigate CVE-2026-23335

Immediate Actions Required

Inventory hosts running Intel E810-series or other adapters that load the irdma driver and prioritize them for patching.
Apply the upstream stable kernel updates referenced by commits 14b47c07, 1b1fac4c, 1f70df00, 2fd37450, 74586c6d, c9bd0007, and cfe96221.
On systems that do not require RDMA, blacklist the irdma module and restrict permissions on /dev/infiniband/ device nodes.

Patch Information

The Linux kernel maintainers have merged fixes across multiple stable branches. The patch zero-initializes the irdma_create_ah_resp structure prior to assigning ah_id, eliminating the leak of the rsvd[4] field. See the kernel.org references for the commits: Kernel Patch 14b47c07, Kernel Patch 1b1fac4c, Kernel Patch 1f70df00, Kernel Patch 2fd37450, Kernel Patch 74586c6d, Kernel Patch c9bd0007, and Kernel Patch cfe96221.

Workarounds

Unload and blacklist the irdma module on hosts that do not run RDMA workloads.
Restrict access to /dev/infiniband/* device files using filesystem ACLs so only trusted RDMA service accounts can open them.
Enforce mandatory access control profiles (SELinux, AppArmor) that deny unprivileged processes from interacting with InfiniBand uverbs interfaces.

bash

# Blacklist the irdma module on systems that do not need RDMA
echo "blacklist irdma" | sudo tee /etc/modprobe.d/blacklist-irdma.conf
sudo rmmod irdma 2>/dev/null || true

# Restrict access to InfiniBand uverbs device nodes
sudo chmod 0600 /dev/infiniband/uverbs* 2>/dev/null || true