CVE-2026-68418
- Source
- https://cve.org/CVERecord?id=CVE-2026-68418
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68418.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2026-68418
- Downstream
- Published
- 2026-08-10T12:04:38.930Z
- Modified
- 2026-08-12T04:24:32.352587529Z
- Summary
- RDMA/irdma: Prevent user-triggered null deref on QP create
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Prevent user-triggered null deref on QP create
Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdmasetupvirt_qp.
While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.userwqebufs was non-zero. The end result is that a user could send a zero userwqebufs value and trigger a null ptr deref.
Fix this by unconditionally calling irdmagetpbl and bailing if it fails, similar to the CQ and SRQ paths.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68418.json" }- References
-
- https://git.kernel.org/stable/c/728211c815f6eef28dd3df2a5b6297483185aa20
- https://git.kernel.org/stable/c/b9b0889071569d43623c260074e159cd8f26adb1
- https://git.kernel.org/stable/c/ec675b4cdfd378d8c9dd8c93126c024f2469bd79
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68418.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-68418
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git