Cloudanix VulnDB

CVE-2026-68418

None

CVSS

—

EPSS

0.2%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's remote direct memory access code lets a local user crash the entire system by sending a specially crafted request.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Null pointer dereference in the RDMA/irdma QP creation path when a user supplies a zero value for user_wqe_bufs, because iwqp->iwpbl is only populated conditionally yet is later unconditionally dereferenced inside irdma_setup_virt_qp.

Why it matters to the business

Local users on systems using the irdma RDMA driver can trigger a kernel crash, causing denial of service and potential loss of availability for RDMA-dependent workloads; no data disclosure or code execution is possible.

How an attack unfolds

An attacker with local access crafts a user-space QP creation request that sets req.user_wqe_bufs to zero; the kernel skips the PBL population step, later dereferences the still-null iwqp->iwpbl pointer, and crashes the system.

How to fix it

Apply the upstream Linux kernel fix that unconditionally invokes irdma_get_pbl during QP creation and aborts on failure, matching the behavior already present for CQ and SRQ paths; rebuild and boot the patched kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting the irdma QP creation code path for an unconditional irdma_get_pbl call that returns early on failure; test by attempting a zero user_wqe_bufs QP create and verifying the operation now fails gracefully instead of dereferencing NULL.

Typical attack path

  1. Obtain local user privileges on a system with the irdma RDMA driver loaded.
  2. Issue an RDMA QP creation request via the RDMA user-space API with user_wqe_bufs set to zero.
  3. Trigger the unconditional dereference inside irdma_setup_virt_qp, causing a kernel NULL pointer dereference and panic.

How to detect it

Search kernel logs for oops or panic messages referencing irdma_setup_virt_qp or null pointer dereference during QP creation; correlate with user-space processes performing RDMA QP create syscalls immediately prior to the crash.

What your security team should do

  • Prioritize patching kernel packages that include the irdma driver on any system exposing RDMA interfaces.
  • Restrict untrusted local accounts from accessing RDMA devices via device permissions or cgroups until patches are deployed.
  • Monitor EPSS and upstream stable kernel releases for any change in exploit maturity.

The record

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.

Affected packages

Ecosystem Package Introduced Fixed