Description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Prevent user-triggered null deref on QP create
Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp.
While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref.
Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | >= b48c24c2d710cf34810c555dcef883a3d35a9c08, < 4e75028c000e9560a7ff66a23d7cd872a967ab7e; >= b48c24c2d710cf34810c555dcef883a3d35a9c08, < d52ff592abfcd56234f266aa245c489f70b1c554; >= b48c24c2d710cf34810c555dcef883a3d35a9c08, < ad68e0b759f9569f0dfea84f035c91eadb979802; >= b48c24c2d710cf34810c555dcef883a3d35a9c08, < ec675b4cdfd378d8c9dd8c93126c024f2469bd79; >= b48c24c2d710cf34810c555dcef883a3d35a9c08, < 728211c815f6eef28dd3df2a5b6297483185aa20; >= b48c24c2d710cf34810c555dcef883a3d35a9c08, < b9b0889071569d43623c260074e159cd8f26adb1 |
| Linux | Linux | 5.14 |
References
- https://git.kernel.org/stable/c/4e75028c000e9560a7ff66a23d7cd872a967ab7e
- https://git.kernel.org/stable/c/728211c815f6eef28dd3df2a5b6297483185aa20
- https://git.kernel.org/stable/c/ad68e0b759f9569f0dfea84f035c91eadb979802
- https://git.kernel.org/stable/c/b9b0889071569d43623c260074e159cd8f26adb1
- https://git.kernel.org/stable/c/d52ff592abfcd56234f266aa245c489f70b1c554
- https://git.kernel.org/stable/c/ec675b4cdfd378d8c9dd8c93126c024f2469bd79
Timeline
- Published
- Aug 10, 2026
- Last modified
- Oct 30, 2026
- NVD status
- Received