CVE-2026-68419

RDMA/irdma: Prevent rereg_mr for non-mem regions

State: Published
Severity: 7.8 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Prevent rereg_mr for non-mem regions

When a QP/CQ/SRQ is created, a two step process is used where the buffer is allocated in userspace and explicitly registered with the normal reg_mr mechanism prior to creating the actual QP/CQ/SRQ object.

These special registrations are indicated via an ABI field so the driver knows that they do not have a valid mkey and to skip the actual CQP command submission.

Since these are real MR objects from the core's perspective, it is possible for a user application to invoke rereg_mr on them and cause a real CQP op to be emitted with the zero-initialized mkey value of 0.

Fix this by preventing rereg_mr on these special regions.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-20 Improper Input Validation

Affected Products

Product	Versions
LinuxLinux	715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 to before fb46d134e1b8690bed2da9005b36d32d2efd34acAffected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before b5029e91c63406e4f4c8d58161048b41b6f0bd8cAffected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before ca1c29f05274b737dc964e28b97803750d7cf7ecAffected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before dbaa37e060918c45517786e37ecab0f300b48fa9Affected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before a846aecb931b4d65d5eafa92a0623545af46d4f2Affected 6.6.120 to before 6.6.148Affected
LinuxLinux	6.7Affected before 6.7Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 to before fb46d134e1b8690bed2da9005b36d32d2efd34acAffected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before b5029e91c63406e4f4c8d58161048b41b6f0bd8cAffected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before ca1c29f05274b737dc964e28b97803750d7cf7ecAffected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before dbaa37e060918c45517786e37ecab0f300b48fa9Affected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before a846aecb931b4d65d5eafa92a0623545af46d4f2Affected
6.6.120 to before 6.6.148Affected

LinuxLinux

6.7Affected
before 6.7Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.