CVE-2026-68418

Summary

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Prevent user-triggered null deref on QP create

Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp.

While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref.

Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxb48c24c2d710cf34810c555dcef883a3d35a9c08 < ec675b4cdfd378d8c9dd8c93126c024f2469bd79affected
LinuxLinuxb48c24c2d710cf34810c555dcef883a3d35a9c08 < 728211c815f6eef28dd3df2a5b6297483185aa20affected
LinuxLinuxb48c24c2d710cf34810c555dcef883a3d35a9c08 < b9b0889071569d43623c260074e159cd8f26adb1affected
LinuxLinux5.14affected
LinuxLinux0 < 5.14unaffected
LinuxLinux6.18.42 <= 6.18.*unaffected
LinuxLinux7.1.6 <= 7.1.*unaffected
LinuxLinux7.2-rc4 <= *unaffected

Weaknesses

References