CVE-2026-68418: RDMA/irdma: Prevent user-triggered null deref on QP create
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Prevent user-triggered null deref on QP create
Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdmasetupvirtqp.
While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.userwqebufs was non-zero. The end result is that a user could send a zero userwqebufs value and trigger a null ptr deref.
Fix this by unconditionally calling irdmagetpbl and bailing if it fails, similar to the CQ and SRQ paths.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68418?
CVE-2026-68418 has a risk rating of 26, indicating a moderate severity level.
How do I fix CVE-2026-68418?
To resolve CVE-2026-68418, update your Linux kernel to the latest patched version that includes the fix.
What type of vulnerability is CVE-2026-68418?
CVE-2026-68418 is classified as a null pointer dereference vulnerability.
What component of the Linux kernel is affected by CVE-2026-68418?
CVE-2026-68418 affects the RDMA/irdma subsystem of the Linux kernel.
Can CVE-2026-68418 be exploited by an attacker?
Yes, CVE-2026-68418 can potentially be exploited by a user to cause a null dereference during queue pair creation.