Riskcovery

CVE-2026-68418

RDMA/irdma: Prevent user-triggered null deref on QP create

State
Published
Severity
Not scored
Published
Aug 10, 2026
Updated
Oct 30, 2026
Reserved
Jul 30, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Prevent user-triggered null deref on QP create

Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp.

While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref.

Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 4e75028c000e9560a7ff66a23d7cd872a967ab7eAffected
  • b48c24c2d710cf34810c555dcef883a3d35a9c08 to before d52ff592abfcd56234f266aa245c489f70b1c554Affected
  • b48c24c2d710cf34810c555dcef883a3d35a9c08 to before ad68e0b759f9569f0dfea84f035c91eadb979802Affected
  • b48c24c2d710cf34810c555dcef883a3d35a9c08 to before ec675b4cdfd378d8c9dd8c93126c024f2469bd79Affected
  • b48c24c2d710cf34810c555dcef883a3d35a9c08 to before 728211c815f6eef28dd3df2a5b6297483185aa20Affected
  • b48c24c2d710cf34810c555dcef883a3d35a9c08 to before b9b0889071569d43623c260074e159cd8f26adb1Affected
LinuxLinux
  • 5.14Affected
  • before 5.14Not affected
  • 6.1.191 through 6.1.*Not affected
  • 6.6.160 through 6.6.*Not affected
  • 6.12.114 through 6.12.*Not affected
  • 6.18.42 through 6.18.*Not affected
  • 7.1.6 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.