Answer in brief
CVE-2026-68418 records a Unknown severity vulnerability in RDMA/irdma: Prevent user-triggered null deref on QP create. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b48c24c2d710cf34810c555dcef883a3d35a9c08 <ec675b4cdfd378d8c9dd8c93126c024f2469bd79 || >=b48c24c2d710cf34810c555dcef883a3d35a9c08 <728211c815f6eef28dd3df2a5b6297483185aa20 || >=b48c24c2d710cf34810c555dcef883a3d35a9c08 <b9b0889071569d43623c260074e159cd8f26adb1 | ec675b4cdfd378d8c9dd8c93126c024f2469bd79, 728211c815f6eef28dd3df2a5b6297483185aa20, b9b0889071569d43623c260074e159cd8f26adb1 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68418 records a Unknown severity vulnerability in RDMA/irdma: Prevent user-triggered null deref on QP create. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b48c24c2d710cf34810c555dcef883a3d35a9c08 <ec675b4cdfd378d8c9dd8c93126c024f2469bd79 || >=b48c24c2d710cf34810c555dcef883a3d35a9c08 <728211c815f6eef28dd3df2a5b6297483185aa20 || >=b48c24c2d710cf34810c555dcef883a3d35a9c08 <b9b0889071569d43623c260074e159cd8f26adb1 | ec675b4cdfd378d8c9dd8c93126c024f2469bd79, 728211c815f6eef28dd3df2a5b6297483185aa20, b9b0889071569d43623c260074e159cd8f26adb1 |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent user-triggered null deref on QP create Previously, the user QP creation path would only attempt to populate iwqp->iwpbl if the user-provided req.user_wqe_bufs field was non-zero. The problem is that iwqp->iwpbl is unconditionally dereferenced later on in irdma_setup_virt_qp. While there was a check for iwqp->iwpbl != NULL, this check would only occur if req.user_wqe_bufs was non-zero. The end result is that a user could send a zero user_wqe_bufs value and trigger a null ptr deref. Fix this by unconditionally calling irdma_get_pbl and bailing if it fails, similar to the CQ and SRQ paths.
Quoted source text, attributed separately from HOL analysis.