Null Dereference Vulnerability in Linux Kernel's RDMA/irdma Component

CVE-2026-68418

What is CVE-2026-68418?

A vulnerability in the Linux kernel's RDMA/irdma component allows a user to trigger a null dereference during the creation of a Queue Pair (QP). This occurs when the user provides a zero value for the 'user_wqe_bufs' field, resulting in an unconditional dereference of the iwqp->iwpbl pointer without proper validation. To mitigate this issue, the kernel's handling has been adjusted to ensure that the 'irdma_get_pbl' function is called unconditionally, providing a safeguard against null pointer dereference and enhancing overall system stability.

References