CVE-2026-68418

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Prevent user-triggered null deref on QP create

Previously, the user QP creation path would only attempt to

populate iwqp->iwpbl if the user-provided req.user_wqe_bufs

field was non-zero. The problem is that iwqp->iwpbl is

unconditionally dereferenced later on in irdma_setup_virt_qp.

While there was a check for iwqp->iwpbl != NULL, this check

would only occur if req.user_wqe_bufs was non-zero. The end

result is that a user could send a zero user_wqe_bufs value

and trigger a null ptr deref.

Fix this by unconditionally calling irdma_get_pbl and bailing

if it fails, similar to the CQ and SRQ paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References