Linux kernel (drivers/infiniband/hw/irdma): Queue-depth arithmetic was done in 32 bits, so a tenant passing a huge

Impact

Queue-depth arithmetic was done in 32 bits, so a tenant passing a huge SQ/RQ/SRQ size overflows the calculation and the driver reports success with a silently truncated queue. The queue the hardware and the userspace library then disagree about is a direct route to out-of-bounds work-queue-entry writes.

Who can reach it

A tenant container holding /dev/infiniband/uverbs* on an Intel irdma node calls create_qp/create_srq with a size near U32_MAX. No fabric peer or host root required.

What to do

No fixed version is listed in the record - take the stable kernel carrying 3f08351de5ca (or cbd852f5700e / e37afcb56ae0) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on irdma nodes.

References

Related entries

• Linux kernel (drivers/infiniband/hw/irdma): A stale flag caused the CQ memory-registration path to read one elementCVE-2026-74346 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): If copying the queue-pair response back to userspace fails, irdma'sCVE-2026-31492 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): A tenant that asks for a user QP while declaring a zero-size work-queueCVE-2026-68418 · Linux kernel (drivers/infiniband/hw/irdma)Medium
• Linux kernel (drivers/infiniband/hw/irdma): The driver signalled completion of control-plane requests through anCVE-2026-72494 · Linux kernel (drivers/infiniband/hw/irdma)Critical
• Linux kernel (drivers/infiniband/hw/irdma): In the physical-buffer-list allocator, a chunk is freed while still linkedCVE-2021-47614 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): Use-after-free on completion-queue teardown. The driver frees the CQCVE-2022-50137 · Linux kernel (drivers/infiniband/hw/irdma)High