CVE-2026-23384

In the Linux kernel, the following vulnerability has been resolved:

RDMA/ionic: Fix kernel stack leak in ioniccreatecq()

struct ioniccqresp resp { __u32 cqid[2]; // offset 0 - PARTIALLY SET (see below) __u8 udmamask; // offset 8 - SET (resp.udmamask = vcq->udma_mask) __u8 rsvd[7]; // offset 9 - NEVER SET <- LEAK };

rsvd[7]: 7 bytes of stack memory leaked unconditionally.

cqid[2]: The loop at line 1256 iterates over udmaidx but skips indices where !(vcq->udmamask & BIT(udmaidx)). The array has 2 entries but udmacount could be 1, meaning cqid[1] might never be written via ioniccreatecqcommon(). If udmamask only has bit 0 set, cqid[1] (4 bytes) is also leaked. So potentially 11 bytes leaked.