Junglewise Threat Intelligence

CVE-2026-23335: Linux Kernel stack leak in irdma_create_user_ah

CVE-2026-23335 · Severity: medium · CVSS 5.5 · Published 2026-03-25

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A security vulnerability has been identified in the Linux kernel's RDMA driver that could allow local users to access sensitive information from the system's memory. This issue affects certain industrial controllers and high-performance networking environments that use specific Intel RDMA hardware. An attacker with local access could potentially exploit this to view data they are not authorized to see, though it does not directly allow for system takeover.

Technical details

A kernel stack leak was discovered in the irdma_create_user_ah() function within the Linux kernel's RDMA driver (drivers/infiniband/hw/irdma/verbs.c). The vulnerability stems from the 'irdma_create_ah_resp' structure, where a 4-byte reserved field ('rsvd') is not zeroed or initialized before being copied back to user space via 'ib_respond_udata()'. This allows a local attacker to read 4 bytes of uninitialized kernel stack memory. The fix involves properly initializing the response structure to zero. The issue has been patched across multiple stable kernel branches.

Affected products

  • Linux Linux Kernel Fixed in 6.1.x, 6.6.x, 6.12.x, 6.13.x, and 7.0+
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-02-16: other: Patch authored by Jason Gunthorpe
  • 2026-03-25: advisory: Initial NVD publication and kernel stable commit date
  • 2026-07-14: other: Siemens advisory information added to CVE record

References

Related threats