{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23289", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.992Z", "datePublished": "2026-03-25T10:26:48.207Z", "dateUpdated": "2026-05-11T22:03:59.470Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:03:59.470Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()\n\nFix a user triggerable leak on the system call failure path."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/mthca/mthca_provider.c"], "versions": [{"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "11ac61f4e9b7c48b0dd44661765e5ace3c441aa3", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "72fcfd4df46f2ee684c4776664d0cfc6c1746c9a", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "f67f1ad4029e9fa183141546de31987b254c9292", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "d0148965dbca8cc8efa7e3d6e99940487bf661c0", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "da8eaa73bc37d004350ba68eb18b6ade8e49db52", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "deee46b37ebd8cc5ff810127883fca90f2412a7b", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "972b72d7e2d8fe1400f1c7a8304c282c539b7e02", "status": "affected", "versionType": "git"}, {"version": "ec34a922d243c3401a694450734e9effb2bafbfe", "lessThan": "117942ca43e2e3c3d121faae530989931b7f67e1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/mthca/mthca_provider.c"], "versions": [{"version": "2.6.14", "status": "affected"}, {"version": "0", "lessThan": "2.6.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.77", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.17", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.7", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "5.10.253"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "5.15.203"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "6.1.167"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "6.6.130"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "6.12.77"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "6.18.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "6.19.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.14", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/11ac61f4e9b7c48b0dd44661765e5ace3c441aa3"}, {"url": "https://git.kernel.org/stable/c/72fcfd4df46f2ee684c4776664d0cfc6c1746c9a"}, {"url": "https://git.kernel.org/stable/c/f67f1ad4029e9fa183141546de31987b254c9292"}, {"url": "https://git.kernel.org/stable/c/d0148965dbca8cc8efa7e3d6e99940487bf661c0"}, {"url": "https://git.kernel.org/stable/c/da8eaa73bc37d004350ba68eb18b6ade8e49db52"}, {"url": "https://git.kernel.org/stable/c/deee46b37ebd8cc5ff810127883fca90f2412a7b"}, {"url": "https://git.kernel.org/stable/c/972b72d7e2d8fe1400f1c7a8304c282c539b7e02"}, {"url": "https://git.kernel.org/stable/c/117942ca43e2e3c3d121faae530989931b7f67e1"}], "title": "IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()\n\nFix a user triggerable leak on the system call failure path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nIB/mthca: A\u00f1adir mthca_unmap_user_db() que se hab\u00eda omitido para mthca_create_srq()\n\nCorregir una fuga activable por el usuario en la ruta de fallo de la llamada al sistema."}], "id": "CVE-2026-23289", "lastModified": "2026-04-18T09:16:16.707", "metrics": {}, "published": "2026-03-25T11:16:23.887", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/117942ca43e2e3c3d121faae530989931b7f67e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/11ac61f4e9b7c48b0dd44661765e5ace3c441aa3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72fcfd4df46f2ee684c4776664d0cfc6c1746c9a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/972b72d7e2d8fe1400f1c7a8304c282c539b7e02"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d0148965dbca8cc8efa7e3d6e99940487bf661c0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/da8eaa73bc37d004350ba68eb18b6ade8e49db52"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/deee46b37ebd8cc5ff810127883fca90f2412a7b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f67f1ad4029e9fa183141546de31987b254c9292"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: IB/mthca: Add missed mthca_unmap_user_db() for mthca_create_srq()", "id": "2451253", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451253"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["A flaw was found in the Linux kernel's IB/mthca component. A local user could exploit this vulnerability by triggering a system call failure path related to the `mthca_create_srq()` function. This oversight leads to a missed unmapping of user database resources, resulting in a resource leak."], "name": "CVE-2026-23289", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23289\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23289\nhttps://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23289-aa54@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec34a922d243c3401a694450734e9effb2bafbfe,f67f1ad4029e9fa183141546de31987b254c9292)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec34a922d243c3401a694450734e9effb2bafbfe,d0148965dbca8cc8efa7e3d6e99940487bf661c0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec34a922d243c3401a694450734e9effb2bafbfe,da8eaa73bc37d004350ba68eb18b6ade8e49db52)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec34a922d243c3401a694450734e9effb2bafbfe,deee46b37ebd8cc5ff810127883fca90f2412a7b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec34a922d243c3401a694450734e9effb2bafbfe,972b72d7e2d8fe1400f1c7a8304c282c539b7e02)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[ec34a922d243c3401a694450734e9effb2bafbfe,117942ca43e2e3c3d121faae530989931b7f67e1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.167,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.130,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.77,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.17,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.7,6.20.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-03-26T15:40:20.613621+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the IB/mthca driver fix; consult the vendor\u2019s update catalog or relevant commit references.", "Verify that the kernel version in use contains the commit that adds the missing mthca_unmap_user_db() call.", "If a patch is not yet available for your distribution, restrict privileged access to the kernel or temporarily disable the IB/mthca driver until a fix is released."], "summary": {"action": "Patch Now", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "The affected product is the Linux kernel, specifically any kernel version that includes the IB/mthca device driver before the patch that adds the missing unmap call. No explicit kernel release numbers are listed in the advisory, so users should verify whether their current kernel contains the commit that fixes the issue.", "description_and_impact": "The kernel\u2019s IB/mthca driver omitted a call to mthca_unmap_user_db() when the mthca_create_srq() routine failed. This oversight caused an uninitialized kernel memory region to remain mapped, allowing a local user to read kernel data. The weakness is classified as a memory management flaw (CWE\u2011772) and results in a potential information disclosure; it does not provide direct code execution or privilege escalation.", "risk_and_exploitability": "The CVSS base score of 5.5 indicates medium severity. The EPSS value is below 1\u202f%, suggesting a low likelihood of exploitation in the wild, and the vulnerability is not cataloged in CISA\u2019s KEV. The attack vector is inferred to be local, requiring a user to trigger a failing mthca_create_srq() system call; the impact is limited to information disclosure through a memory leak, so overall risk remains moderate. Nevertheless, applying the kernel patch eliminates the vulnerability."}}}}, "created": "2026-03-25T21:15:41.313928+00:00", "updated": "2026-03-27T09:50:16.820254+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}