Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
References
- https://git.kernel.org/stable/c/728211c815f6eef28dd3df2a5b6297483185aa20
- https://git.kernel.org/stable/c/b9b0889071569d43623c260074e159cd8f26adb1
- https://git.kernel.org/stable/c/ec675b4cdfd378d8c9dd8c93126c024f2469bd79
FAQ
What is CVE-2026-68418?
CVE-2026-68418 is a documented vulnerability. In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iw...
How severe is CVE-2026-68418?
CVSS scoring is not yet available for CVE-2026-68418. Check NVD for updates.
Is there a patch for CVE-2026-68418?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.