CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/728211c815f6eef28dd3df2a5b6297483185aa20
https://git.kernel.org/stable/c/b9b0889071569d43623c260074e159cd8f26adb1
https://git.kernel.org/stable/c/ec675b4cdfd378d8c9dd8c93126c024f2469bd79

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-10 13:20

Updated : 2026-08-17 06:17

NVD link : CVE-2026-68418

Mitre link : CVE-2026-68418

CVE.ORG link : CVE-2026-68418

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-68418", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08", "lessThan": "ec675b4cdfd378d8c9dd8c93126c024f2469bd79", "versionType": "git"}, {"status": "affected", "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08", "lessThan": "728211c815f6eef28dd3df2a5b6297483185aa20", "versionType": "git"}, {"status": "affected", "version": "b48c24c2d710cf34810c555dcef883a3d35a9c08", "lessThan": "b9b0889071569d43623c260074e159cd8f26adb1", "versionType": "git"}], "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"status": "unaffected", "version": "0", "lessThan": "5.14", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.42", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.6", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:20:35.623", "references": [{"url": "https://git.kernel.org/stable/c/728211c815f6eef28dd3df2a5b6297483185aa20", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b9b0889071569d43623c260074e159cd8f26adb1", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/ec675b4cdfd378d8c9dd8c93126c024f2469bd79", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Prevent user-triggered null deref on QP create\n\nPreviously, the user QP creation path would only attempt to\npopulate iwqp->iwpbl if the user-provided req.user_wqe_bufs\nfield was non-zero. The problem is that iwqp->iwpbl is\nunconditionally dereferenced later on in irdma_setup_virt_qp.\n\nWhile there was a check for iwqp->iwpbl != NULL, this check\nwould only occur if req.user_wqe_bufs was non-zero. The end\nresult is that a user could send a zero user_wqe_bufs value\nand trigger a null ptr deref.\n\nFix this by unconditionally calling irdma_get_pbl and bailing\nif it fails, similar to the CQ and SRQ paths."}], "lastModified": "2026-08-17T06:17:50.810", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}