CVE-2026-46127: RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdma_copy_pd_uresp()
In the Linux kernel, the following vulnerability has been resolved:
RDMA/ocrdma: Don't NULL deref uctx on errors in ocrdmacopypduresp()
Sashiko points out that pd->uctx isn't initialized until late in the function so all these error flow references are NULL and will crash. Use the uctx that isn't NULL.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems running an affected Linux kernel with the RDMA ocrdma driver in use are exposed. The listed affected software includes the Linux kernel and Microsoft azl3 kernel 6.6.139.1-1.
What access does an attacker need?
The supplied CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the likely impact of successful exploitation?
The issue can trigger a NULL pointer dereference in an error path, causing an availability impact through a crash. The supplied vector indicates no confidentiality or integrity impact.