CVE-2026-68418 is a vulnerability in Linux Kernel
Published on August 10, 2026
RDMA/irdma: Prevent user-triggered null deref on QP create
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Prevent user-triggered null deref on QP create
Previously, the user QP creation path would only attempt to
populate iwqp->iwpbl if the user-provided req.user_wqe_bufs
field was non-zero. The problem is that iwqp->iwpbl is
unconditionally dereferenced later on in irdma_setup_virt_qp.
While there was a check for iwqp->iwpbl != NULL, this check
would only occur if req.user_wqe_bufs was non-zero. The end
result is that a user could send a zero user_wqe_bufs value
and trigger a null ptr deref.
Fix this by unconditionally calling irdma_get_pbl and bailing
if it fails, similar to the CQ and SRQ paths.
Products Associated with CVE-2026-68418
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version b48c24c2d710cf34810c555dcef883a3d35a9c08 and below ec675b4cdfd378d8c9dd8c93126c024f2469bd79 is affected.
- Version b48c24c2d710cf34810c555dcef883a3d35a9c08 and below 728211c815f6eef28dd3df2a5b6297483185aa20 is affected.
- Version b48c24c2d710cf34810c555dcef883a3d35a9c08 and below b9b0889071569d43623c260074e159cd8f26adb1 is affected.
- Version 5.14 is affected.
- Before 5.14 is unaffected.
- Version 6.18.42, <= 6.18.* is unaffected.
- Version 7.1.6, <= 7.1.* is unaffected.
- Version 7.2-rc4, <= * is unaffected.