Linux kernel (drivers/infiniband/hw/irdma): If copying the queue-pair response back to userspace fails, irdma's

CVSS 5.5CVE-2026-31492Firmware, BMC & network fabriccurated

Impact

If copying the queue-pair response back to userspace fails, irdma's create-QP error path calls destroy, which waits on a completion structure that was never initialized. A tenant that supplies a bad response buffer walks the kernel into a wait on uninitialized memory - an indefinite hang or corruption on a node shared with other tenants.

Who can reach it

Local and unprivileged: a tenant holding /dev/infiniband/uverbs* on an Intel irdma adapter issues create-QP with a udata buffer that cannot be written (unmapped or partially mapped), forcing ib_copy_to_udata to fail. No fabric peer or root needed. Conditional on irdma hardware (E810 / X722 RDMA) being present.

What to do

No fixed version is recorded in this entry; boot a stable kernel carrying the completion-init fix (commits ac1da7bd224d / af310407f79d). Interim: remove /dev/infiniband device nodes from untrusted tenant containers on irdma nodes.

References

https://git.kernel.org/stable/c/ac1da7bd224d406b6f1b84414f0f652ab43b6bd8 https://git.kernel.org/stable/c/af310407f79d5816fc0ab3638e1588b6193316dd https://nvd.nist.gov/vuln/detail/CVE-2026-31492

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.