{"id":"CVE-2026-68419","title":"RDMA/irdma: Prevent rereg_mr for non-mem regions","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Prevent rereg_mr for non-mem regions\n\nWhen a QP/CQ/SRQ is created, a two step process is used\nwhere the buffer is allocated in userspace and explicitly\nregi…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 < fb46d134e1b8690bed2da9005b36d32d2efd34ac","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < b5029e91c63406e4f4c8d58161048b41b6f0bd8c","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < ca1c29f05274b737dc964e28b97803750d7cf7ec","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < dbaa37e060918c45517786e37ecab0f300b48fa9","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < a846aecb931b4d65d5eafa92a0623545af46d4f2","Linux >= 6.6.120 < 6.6.148","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:48:37.991046Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:53:12.780Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68419","references":[{"url":"https://git.kernel.org/stable/c/fb46d134e1b8690bed2da9005b36d32d2efd34ac"},{"url":"https://git.kernel.org/stable/c/b5029e91c63406e4f4c8d58161048b41b6f0bd8c"},{"url":"https://git.kernel.org/stable/c/ca1c29f05274b737dc964e28b97803750d7cf7ec"},{"url":"https://git.kernel.org/stable/c/dbaa37e060918c45517786e37ecab0f300b48fa9"},{"url":"https://git.kernel.org/stable/c/a846aecb931b4d65d5eafa92a0623545af46d4f2"}],"tags":["cve.org"],"epss":0.00129,"epssPercentile":0.02207,"ingestedAt":"2026-10-16T17:24:46.865Z","slug":"CVE-2026-68419","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Prevent rereg_mr for non-mem regions\n\nWhen a QP/CQ/SRQ is created, a two step process is used\nwhere the buffer is allocated in userspace and explicitly\nregistered with the normal reg_mr mechanism prior to creating\nthe actual QP/CQ/SRQ object.\n\nThese special registrations are indicated via an ABI field\nso the driver knows that they do not have a valid mkey and\nto skip the actual CQP command submission.\n\nSince these are real MR objects from the core's perspective,\nit is possible for a user application to invoke rereg_mr on them\nand cause a real CQP op to be emitted with the zero-initialized\nmkey value of 0.\n\nFix this by preventing rereg_mr on these special regions.\n\n## Affected\n\n- `Linux >= 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 < fb46d134e1b8690bed2da9005b36d32d2efd34ac`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < b5029e91c63406e4f4c8d58161048b41b6f0bd8c`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < ca1c29f05274b737dc964e28b97803750d7cf7ec`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < dbaa37e060918c45517786e37ecab0f300b48fa9`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < a846aecb931b4d65d5eafa92a0623545af46d4f2`\n- `Linux >= 6.6.120 < 6.6.148`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}