CVE-2026-52995

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Linux kernel where the functions rds for each conn info() and rds walk conn path info() pass a caller-allocated on-stack u64 buffer to a per-connection visitor. The system then copies the full item len bytes back to user space via rds info copy(), regardless of how much data the visitor actually wrote. Specifically, rds ib conn info visitor() and rds6 ib conn info visitor() only write a subset of their output structure when the rds connection is not in the RDS CONN UP state. This results in several u32 fields—including max send wr, max recv wr, max send sge, rdma mr max, rdma mr size, and cache allocs—and a 2-byte alignment hole containing uninitialized stack memory being leaked to user space. This leaked data can include sensitive kernel text and data pointers. The issue is reproducible on kernels built without CONFIG INIT STACK ALL ZERO=y by using getsockopt() with the RDS INFO IB CONNECTIONS option.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.