SB2026032561 - Exposure of sensitive information to an unauthorized actor in Linux kernel hw ionic driver

Description

This security bulletin contains information about 1 security vulnerability.

1) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2026-23384)

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper initialization of stack memory in the RDMA/ionic driver when handling control queue creation. A local user can trigger the creation of a control queue via the ionic_create_cq() interface, causing uninitialized stack memory to be returned to userspace, which may disclose up to 11 bytes of kernel stack data.

The disclosed data may include portions of kernel stack memory due to partial initialization of the response structure before being copied to userspace.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/547d0b07ad73915b323bc21f85c5d3252bebbbcf
• https://git.kernel.org/stable/c/a6f3e0fa8e862f220c26c2f27e5ddc42eb82ad3e
• https://git.kernel.org/stable/c/faa72102b178c7ae6c6afea23879e7c84fc59b4e