CVE-2026-68418: Linux Kernel RDMA Use-After-Free Flaw

CVE-2026-68418 Overview

CVE-2026-68418 is a null pointer dereference vulnerability in the Linux kernel's RDMA/irdma driver, specifically in the user Queue Pair (QP) creation path. The flaw allows a local unprivileged user to trigger a kernel null pointer dereference by supplying a zero value in the req.user_wqe_bufs field when creating a QP. The kernel then unconditionally dereferences iwqp->iwpbl in irdma_setup_virt_qp, causing a crash. This issue has been resolved upstream in the mainline and stable Linux kernel trees.

Critical Impact
A local user with access to the irdma RDMA device can trigger a kernel null pointer dereference, resulting in denial of service on affected systems.

Affected Products

Linux kernel builds shipping the irdma RDMA driver
Distributions using vulnerable stable kernel branches prior to the referenced fix commits
Systems with Intel Ethernet RDMA (irdma) devices exposed to unprivileged users

Discovery Timeline

2026-08-10 - CVE-2026-68418 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68418

Vulnerability Analysis

The vulnerability resides in the user QP creation path of the Intel irdma RDMA driver. When user space issues a QP create request, the driver conditionally populates the iwqp->iwpbl structure only if the caller-supplied req.user_wqe_bufs field is non-zero. Later, irdma_setup_virt_qp dereferences iwqp->iwpbl unconditionally. The existing null check for iwqp->iwpbl is also guarded by the same req.user_wqe_bufs condition, so it never runs when the user provides a zero value. As a result, an unprivileged user with access to the RDMA character device can supply user_wqe_bufs = 0 and trigger a kernel null pointer dereference. This is a classic [CWE-476] null pointer dereference issue reachable from user space.

Root Cause

The root cause is inconsistent input validation. The driver treats iwqp->iwpbl as always populated in downstream code paths while its initialization is gated on user-controlled input. The CQ and SRQ creation paths already handle this correctly by unconditionally calling irdma_get_pbl and returning on failure. The user QP path did not follow the same pattern.

Attack Vector

An attacker requires local access and the ability to open the irdma uverbs device node. The attacker then issues a QP creation ioctl with a zero-valued user_wqe_bufs field. The kernel dereferences the uninitialized iwqp->iwpbl pointer, producing an oops and kernel task termination. Repeated abuse can cause sustained denial of service on the host. See the upstream fix at kernel.org commit b9b0889071569 for the corrected logic.

Detection Methods for CVE-2026-68418

Indicators of Compromise

Kernel oops or BUG messages referencing irdma_setup_virt_qp or irdma_get_pbl in dmesg or journalctl -k
Unexpected process terminations or kernel taints on hosts running the irdma driver
Repeated QP creation failures originating from non-privileged user contexts

Detection Strategies

Monitor kernel logs for null pointer dereference stack traces containing irdma symbols
Audit which local users and containers have access to /dev/infiniband/uverbs* device nodes
Correlate RDMA verbs usage with unexpected kernel panics or driver reload events

Monitoring Recommendations

Forward kernel logs to a centralized logging platform and alert on irdma oops signatures
Track loaded kernel module versions across the fleet and flag hosts running unpatched irdma
Baseline legitimate RDMA workloads so anomalous QP creation activity from user sessions is visible

How to Mitigate CVE-2026-68418

Immediate Actions Required

Apply the latest stable kernel update from your distribution that includes the referenced irdma fix commits
Restrict access to RDMA uverbs device nodes to trusted service accounts only
If the irdma driver is not required, blacklist the module to eliminate the attack surface

Patch Information

The fix modifies the user QP creation path to unconditionally call irdma_get_pbl and bail out on failure, mirroring the CQ and SRQ paths. Patches are available in the stable kernel tree at commit 728211c815f6, commit b9b088907156, and commit ec675b4cdfd3. Rebuild or update to a kernel that incorporates these commits.

Workarounds

Unload the irdma module with modprobe -r irdma on systems that do not require RDMA acceleration
Restrict permissions on /dev/infiniband/* to limit which local users can issue verbs ioctls
Use container and namespace policies to prevent unprivileged workloads from accessing RDMA devices

bash

# Configuration example: blacklist the irdma driver until patched
echo 'blacklist irdma' | sudo tee /etc/modprobe.d/blacklist-irdma.conf
sudo modprobe -r irdma
sudo update-initramfs -u