Linux kernel (drivers/infiniband/hw/irdma): A tenant that asks for a user QP while declaring a zero-size work-queue

Impact

A tenant that asks for a user QP while declaring a zero-size work-queue buffer leaves a pointer unpopulated that the driver then dereferences unconditionally. The kernel takes a NULL dereference in a syscall path, which oopses the task and, in the wrong context, brings the node down - a noisy-neighbour outage for every other tenant sharing the box.

Who can reach it

One ibv_create_qp call with user_wqe_bufs set to zero from any container holding /dev/infiniband/uverbs* on an Intel irdma node. Trivially reachable, no fabric peer, no privilege beyond the device node.

What to do

No fixed version is listed in the record - take the stable kernel carrying ec675b4cdfd3 (or 728211c815f6 / b9b0889071569) and reboot. Interim: remove /dev/infiniband/* from untrusted containers on irdma nodes.

References

Related entries

• Linux kernel (drivers/infiniband/hw/irdma): The driver signalled completion of control-plane requests through anCVE-2026-72494 · Linux kernel (drivers/infiniband/hw/irdma)Critical
• Linux kernel (drivers/infiniband/hw/irdma): In the physical-buffer-list allocator, a chunk is freed while still linkedCVE-2021-47614 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): Use-after-free on completion-queue teardown. The driver frees the CQCVE-2022-50137 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): The pseudo memory regions that back a QP/CQ/SRQ have no real hardware keyCVE-2026-68419 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): The page-address copy loop only honoured its bound when the bound wasCVE-2026-74390 · Linux kernel (drivers/infiniband/hw/irdma)High
• Linux kernel (drivers/infiniband/hw/irdma): A permanent kernel hang once any queue-pair goes to error.CVE-2022-48694 · Linux kernel (drivers/infiniband/hw/irdma)High