CVE-2026-68419: Linux Kernel Privilege Escalation Flaw

CVE-2026-68419 Overview

CVE-2026-68419 is a Linux kernel vulnerability in the Intel RDMA driver (irdma) that allows local users to trigger invalid Control Queue Pair (CQP) operations. The flaw occurs because the driver permits rereg_mr calls on special memory regions used to back Queue Pair (QP), Completion Queue (CQ), and Shared Receive Queue (SRQ) objects. These regions carry a zero-initialized memory key (mkey) that should never reach the hardware. A local user with RDMA access can submit a real CQP command with the invalid mkey value of 0, resulting in kernel-side impact to confidentiality, integrity, and availability.

Critical Impact
A local, low-privileged user with access to the irdma interface can invoke rereg_mr on special memory regions and drive kernel CQP command submission with a zero mkey, corrupting driver state.

Affected Products

Linux kernel builds shipping the RDMA/irdma driver prior to the referenced stable commits
Distributions consuming affected mainline and stable branches of the Linux kernel
Systems with Intel Ethernet RDMA hardware exposing irdma to unprivileged userspace

Discovery Timeline

2026-08-10 - CVE-2026-68419 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68419

Vulnerability Analysis

The irdma driver uses a two-step process when userspace creates a QP, CQ, or SRQ. Userspace first allocates a backing buffer and registers it through the normal reg_mr path. The driver flags these registrations through an ABI field so it can skip the actual CQP command submission, because the memory region does not have a valid mkey. From the RDMA core's perspective, however, these are ordinary memory region objects. A local user can therefore call rereg_mr on them, which the driver forwards to hardware as a legitimate CQP re-register operation using the uninitialized mkey of 0. This drives the device with an invalid handle and corrupts the associated kernel resource state ([CWE-665] improper initialization category). The issue is a [Kernel Vulnerability] and [Driver Vulnerability] localized to the irdma provider.

Root Cause

The driver does not distinguish between standard memory regions and the special buffer registrations used to back QP, CQ, and SRQ objects when servicing rereg_mr. Because the ABI marker that suppresses initial CQP submission is not consulted on re-registration, the driver emits a CQP operation with the zero-value mkey that these regions carry.

Attack Vector

Exploitation requires local access and the ability to open the irdma uverbs device. An attacker first creates a QP, CQ, or SRQ, obtaining a handle to the underlying special memory region. The attacker then issues an ibv_rereg_mr request against that region. The driver submits a CQP re-register command with mkey = 0, producing kernel-side effects on the RDMA control path. No user interaction is required and privileges required are limited to whatever access controls gate the RDMA verbs interface on the host.

No public proof-of-concept has been published for CVE-2026-68419. See the upstream commits in the Linux kernel stable tree for the exact code path and fix.

Detection Methods for CVE-2026-68419

Indicators of Compromise

Unexpected irdma driver errors or CQP command failures in dmesg referencing invalid mkey values
Local processes without a legitimate RDMA workload opening /dev/infiniband/uverbs* devices
Anomalous ibv_rereg_mr calls issued shortly after QP, CQ, or SRQ creation by the same process

Detection Strategies

Audit kprobes or tracepoints on irdma_rereg_user_mr and related uverbs entry points to identify re-registration attempts on QP/CQ/SRQ backing regions
Correlate uverbs command activity with process lineage to flag non-RDMA workloads exercising verbs interfaces
Baseline expected RDMA users on each host and alert on new local principals invoking verbs syscalls

Monitoring Recommendations

Forward kernel logs referencing irdma, CQP, and mkey errors to a central logging or SIEM tier for correlation
Track loaded kernel modules and driver versions across the fleet, alerting when hosts run pre-patch irdma builds
Monitor for kernel warnings or oopses on hosts exposing RDMA to multi-tenant workloads

How to Mitigate CVE-2026-68419

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected hosts
Restrict access to /dev/infiniband/uverbs* to trusted service accounts using file permissions and udev rules
Inventory hosts running the irdma driver and prioritize patching for multi-tenant or user-accessible systems

Patch Information

The fix prevents rereg_mr from operating on the special memory regions that back QP, CQ, and SRQ objects. Patched code paths are available in the following upstream commits: a846aecb931b, b5029e91c634, ca1c29f05274, dbaa37e06091, and fb46d134e1b8. Consume the fix through your distribution's kernel update channel where available.

Workarounds

Unload the irdma module on systems that do not require RDMA services using modprobe -r irdma and blacklist it in /etc/modprobe.d/
Restrict uverbs device permissions so only vetted RDMA workloads can invoke verbs syscalls
Isolate workloads that require RDMA on dedicated hosts to reduce local attacker exposure to the driver

bash

# Configuration example: disable irdma where not needed
echo 'blacklist irdma' | sudo tee /etc/modprobe.d/disable-irdma.conf
sudo modprobe -r irdma
sudo update-initramfs -u