CVE-2026-68419

Received Received - Intake

RDMA rereg_mr Denial of Service in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent rereg_mr for non-mem regions When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal reg_mr mechanism prior to creating the actual QP/CQ/SRQ object. These special registrations are indicated via an ABI field so the driver knows that they do not have a valid mkey and to skip the actual CQP command submission. Since these are real MR objects from the core's perspective, it is possible for a user application to invoke rereg_mr on them and cause a real CQP op to be emitted with the zero-initialized mkey value of 0. Fix this by preventing rereg_mr on these special regions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68419

EUVD

EUVD-2026-55605

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the RDMA/irdma driver where special memory regions created during QP/CQ/SRQ setup can be incorrectly reregistered. Normally these regions use a zero mkey value and skip CQP commands, but a user application can trigger a rereg_mr operation, causing the driver to send an invalid CQP command with mkey=0. The fix prevents rereg_mr on these special regions.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/irdma driver and involves improper handling of memory region registrations. Detection would require checking kernel logs for RDMA-related errors or examining driver behavior during memory region operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow a local attacker to cause a denial of service or potentially escalate privileges by triggering invalid memory operations in the RDMA subsystem. Systems using affected RDMA/irdma drivers may experience crashes or instability.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a specific kernel-level memory management issue in the RDMA subsystem. No evidence suggests data exposure or unauthorized access risks that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the RDMA/irdma rereg_mr vulnerability. Monitor vendor advisories for kernel updates specific to your distribution.

Hi! I’m here to help you understand CVE-2026-68419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70