---
id: CVE-2026-68419
title: 'RDMA/irdma: Prevent rereg_mr for non-mem regions'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/irdma: Prevent rereg_mr for non-mem regions

  When a QP/CQ/SRQ is created, a two step process is used
  where the buffer is allocated in userspace and explicitly
  regi…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 <
    fb46d134e1b8690bed2da9005b36d32d2efd34ac
  - >-
    Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a <
    b5029e91c63406e4f4c8d58161048b41b6f0bd8c
  - >-
    Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a <
    ca1c29f05274b737dc964e28b97803750d7cf7ec
  - >-
    Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a <
    dbaa37e060918c45517786e37ecab0f300b48fa9
  - >-
    Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a <
    a846aecb931b4d65d5eafa92a0623545af46d4f2
  - Linux >= 6.6.120 < 6.6.148
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:48:37.991046Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:12.780Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68419'
references:
  - url: 'https://git.kernel.org/stable/c/fb46d134e1b8690bed2da9005b36d32d2efd34ac'
  - url: 'https://git.kernel.org/stable/c/b5029e91c63406e4f4c8d58161048b41b6f0bd8c'
  - url: 'https://git.kernel.org/stable/c/ca1c29f05274b737dc964e28b97803750d7cf7ec'
  - url: 'https://git.kernel.org/stable/c/dbaa37e060918c45517786e37ecab0f300b48fa9'
  - url: 'https://git.kernel.org/stable/c/a846aecb931b4d65d5eafa92a0623545af46d4f2'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02207
ingestedAt: '2026-10-16T17:24:46.865Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Prevent rereg_mr for non-mem regions

When a QP/CQ/SRQ is created, a two step process is used
where the buffer is allocated in userspace and explicitly
registered with the normal reg_mr mechanism prior to creating
the actual QP/CQ/SRQ object.

These special registrations are indicated via an ABI field
so the driver knows that they do not have a valid mkey and
to skip the actual CQP command submission.

Since these are real MR objects from the core's perspective,
it is possible for a user application to invoke rereg_mr on them
and cause a real CQP op to be emitted with the zero-initialized
mkey value of 0.

Fix this by preventing rereg_mr on these special regions.

## Affected

- `Linux >= 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 < fb46d134e1b8690bed2da9005b36d32d2efd34ac`
- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < b5029e91c63406e4f4c8d58161048b41b6f0bd8c`
- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < ca1c29f05274b737dc964e28b97803750d7cf7ec`
- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < dbaa37e060918c45517786e37ecab0f300b48fa9`
- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < a846aecb931b4d65d5eafa92a0623545af46d4f2`
- `Linux >= 6.6.120 < 6.6.148`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.