CVE-2026-68425 Overview
CVE-2026-68425 affects the Linux kernel's InfiniBand Management Datagram (IB/mad) subsystem. The vulnerability resides in Reliable Multi-Packet Protocol (RMPP) receive processing, where reassembly begins before responses are matched against outstanding sends. An attacker on an adjacent network can send unsolicited RMPP DATA responses that route to a kernel RMPP agent by high Transaction ID (TID) bits, allocating or extending RMPP receive state without a corresponding request.
Critical Impact
Reordered response bursts can reach the receive-side insertion path and manipulate kernel RMPP state, leading to availability impact on InfiniBand-connected systems.
Affected Products
- Linux kernel (IB/mad subsystem)
- Systems using InfiniBand with kernel-handled RMPP agents
- Distributions shipping vulnerable kernel versions prior to the referenced stable commits
Discovery Timeline
- 2026-08-10 - CVE-2026-68425 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68425
Vulnerability Analysis
The flaw exists in the kernel-handled RMPP receive path within the InfiniBand management datagram subsystem. RMPP reassembly starts for active DATA responses before ib_process_rmpp_recv_wc() matches the response to an outstanding send. The normal match against the full TID, management class, and source address occurs later, after reassembly has already assembled a complete message or consumed the segment.
This ordering allows an unsolicited response routed to a kernel RMPP agent via high TID bits to allocate or extend RMPP receive state before validation. A reordered burst can reach the receive-side insertion path even when the response does not correspond to any legitimate send. The impact centers on integrity of RMPP state tracking and availability of the InfiniBand management path.
Root Cause
The root cause is an ordering defect. Kernel-handled RMPP DATA responses enter reassembly logic before the send-matching function ib_find_send_mad() verifies the response against agent wait lists, backlog, and in-flight send lists. Without a prior match, unsolicited traffic can create or extend RMPP state entries.
Attack Vector
Exploitation requires adjacent network access to the InfiniBand fabric. An attacker crafts RMPP DATA responses whose high TID bits route them to a kernel RMPP agent. By sending reordered bursts, the attacker triggers state allocation in the receive path. No authentication or user interaction is required.
No verified public proof-of-concept exists. For technical details, see the Kernel Git Commit - Fixes and the Kernel Git Commit - Updates.
Detection Methods for CVE-2026-68425
Indicators of Compromise
- Unexpected RMPP receive state allocations for TIDs with no matching outstanding send in kernel logs
- Anomalous InfiniBand management datagram traffic patterns showing DATA responses without preceding requests
- Kernel warnings or memory growth associated with the ib_mad subsystem
Detection Strategies
- Monitor dmesg and kernel ring buffer output for messages originating from the ib_mad module related to RMPP reassembly anomalies
- Baseline InfiniBand management traffic volumes and alert on sudden increases of unsolicited DATA responses on the fabric
- Track kernel memory usage attributed to the InfiniBand subsystem for unexplained growth
Monitoring Recommendations
- Enable verbose logging on IB subnet managers to capture RMPP flow anomalies across the fabric
- Correlate host-level kernel messages with switch-level fabric telemetry for cross-layer visibility
- Track kernel version inventory across InfiniBand-connected hosts to identify unpatched systems
How to Mitigate CVE-2026-68425
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor-provided kernel updates become available
- Inventory all systems with InfiniBand host channel adapters and confirm kernel versions
- Restrict physical and logical access to the InfiniBand fabric to trusted hosts only
Patch Information
The fix requires ib_find_send_mad() to match kernel-handled RMPP DATA responses before entering reassembly. If no match exists against the full TID, management class, and source address or GID, the response is dropped without creating RMPP state. Patch commits are available in the stable kernel tree: 6e1bd7f5, 98d2d468, ad9c9ad3, d2e52d61, and dfa535c9.
Workarounds
- Isolate InfiniBand fabrics from untrusted hosts using subnet partitioning where feasible
- Disable unused kernel-handled RMPP agents on systems that do not require them
- Apply strict network segmentation policies to reduce adjacent-network exposure to the IB fabric
# Verify running kernel version and IB modules
uname -r
lsmod | grep -E 'ib_mad|ib_core|rdma'
# After applying the vendor-provided patched kernel, reboot and reverify
sudo reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
