CVE-2026-68418

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Prevent user-triggered null deref on QP create

Previously, the user QP creation path would only attempt to

populate iwqp->iwpbl if the user-provided req.user_wqe_bufs

field was non-zero. The problem is that iwqp->iwpbl is

unconditionally dereferenced later on in irdma_setup_virt_qp.

While there was a check for iwqp->iwpbl != NULL, this check

would only occur if req.user_wqe_bufs was non-zero. The end

result is that a user could send a zero user_wqe_bufs value

and trigger a null ptr deref.

Fix this by unconditionally calling irdma_get_pbl and bailing

if it fails, similar to the CQ and SRQ paths.