AZL-95085
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-95085.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-95085
- Upstream
- Published
- 2026-08-10T13:20:35Z
- Modified
- 2026-08-31T05:26:27Z
- Summary
- CVE-2026-68418 affecting package kernel 6.6.150.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
RDMA/irdma: Prevent user-triggered null deref on QP create
Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.userwqebufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdmasetupvirt_qp.
While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.userwqebufs was non-zero. The end result is that a user could send a zero userwqebufs value and trigger a null ptr deref.
Fix this by unconditionally calling irdmagetpbl and bailing if it fails, similar to the CQ and SRQ paths.
- References