CVE-2026-23335

Katalog CVE

CVSS 5.5 · Medium EPSS 0,13%

Kerentanan Missing Release of Memory after Effective Lifetime pada linux kernel. Skor CVSS 3.1 5.5 (Medium) menurut NVD.

Deskripsi (NVD)

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() struct irdma_create_ah_resp { // 8 bytes, no padding __u32 ah_id; // offset 0 - SET (uresp.ah_id = ah->sc_ah.ah_info.ah_idx) __u8 rsvd[4]; // offset 4 - NEVER SET <- LEAK }; rsvd[4]: 4 bytes of stack memory leaked unconditionally. Only ah_id is assigned before ib_respond_udata(). The reserved members of the structure were not zeroed.

Rincian

Terbit di NVD

25 Maret 2026

Terakhir diubah

14 Juli 2026

Status NVD

Modified

CVSS 3.1

5.5 (Medium), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-401: Missing Release of Memory after Effective Lifetime

EPSS (30 hari)

0,13% peluang dieksploitasi; lebih tinggi dari 1,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://git.kernel.org/stable/c/14b47c07c69930254f549a17ee245c80a65b1609 patch
• https://git.kernel.org/stable/c/1b1fac4c7a3ab7f52e9cfb91e5c91216646ca4d8 patch
• https://git.kernel.org/stable/c/1f70df004fdd944653013ccc2e1dfd472a693b46 patch
• https://git.kernel.org/stable/c/2fd37450d271d74b3847baed284f9cfdf198c6f8 patch
• https://git.kernel.org/stable/c/74586c6da9ea222a61c98394f2fc0a604748438c patch
• https://git.kernel.org/stable/c/c9bd0007c4bdb7806bbd323287e50f9cf467c51a patch
• https://git.kernel.org/stable/c/cfe962216c164fe2b1c1fb6ac925a7413f5abc84 patch
• https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html