{"api_version":"1","generated_at":"2026-08-22T01:52:01+00:00","cve":"CVE-2026-68425","urls":{"html":"https://cve.report/CVE-2026-68425","api":"https://cve.report/api/cve/CVE-2026-68425.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-68425","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-68425"},"summary":{"title":"IB/mad: Drop unmatched RMPP responses before reassembly","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mad: Drop unmatched RMPP responses before reassembly\n\nKernel-handled RMPP receive processing starts reassembly for active\nDATA responses before the response is matched to an outstanding send.\nThe normal match happens later, after ib_process_rmpp_recv_wc() has\neither assembled a complete message or consumed the segment.\n\nThat ordering lets an unsolicited response that routes to a kernel\nRMPP agent by the high TID bits allocate or extend RMPP receive state\nbefore the full TID and source address are checked against a real\nrequest. A reordered burst can therefore reach the receive-side\ninsertion path even though the response would not match any send.\n\nFor kernel-handled RMPP DATA responses, require the existing\nib_find_send_mad() match before entering RMPP reassembly. The matcher\nalready checks the full TID, management class and source address/GID\nagainst the agent wait, backlog and in-flight send lists. If there is\nno match, drop the response without creating RMPP state.\n\nThis leaves the RMPP window behavior unchanged and only rejects\nresponses that have no corresponding request.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-10 13:20:36","updated_at":"2026-08-19 17:20:49"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.1","severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","data":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/dfa535c94406c03d3f0c869ef3ba5528e395737c","name":"https://git.kernel.org/stable/c/dfa535c94406c03d3f0c869ef3ba5528e395737c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/d2e52d610b9b09694261632340b801a421e0b0c5","name":"https://git.kernel.org/stable/c/d2e52d610b9b09694261632340b801a421e0b0c5","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/bfb9e8243fd2099d1080d09222964d988f991d9b","name":"https://git.kernel.org/stable/c/bfb9e8243fd2099d1080d09222964d988f991d9b","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/9634fb1f4d404f36a20ffbcb8797369db69b06bb","name":"https://git.kernel.org/stable/c/9634fb1f4d404f36a20ffbcb8797369db69b06bb","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/ad9c9ad3204f63a46f0f7de29687a8e512f05e29","name":"https://git.kernel.org/stable/c/ad9c9ad3204f63a46f0f7de29687a8e512f05e29","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/98d2d468b4faa1fdc68c0c6c238389906ee3490c","name":"https://git.kernel.org/stable/c/98d2d468b4faa1fdc68c0c6c238389906ee3490c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72","name":"https://git.kernel.org/stable/c/6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/45416c87ebcece1e90f3bc5bc172d106b77c6b69","name":"https://git.kernel.org/stable/c/45416c87ebcece1e90f3bc5bc172d106b77c6b69","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-68425","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68425","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e 45416c87ebcece1e90f3bc5bc172d106b77c6b69 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e 9634fb1f4d404f36a20ffbcb8797369db69b06bb git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e bfb9e8243fd2099d1080d09222964d988f991d9b git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e dfa535c94406c03d3f0c869ef3ba5528e395737c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e 6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e 98d2d468b4faa1fdc68c0c6c238389906ee3490c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e ad9c9ad3204f63a46f0f7de29687a8e512f05e29 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected fa619a77046bef30478697aba0553991033afb8e d2e52d610b9b09694261632340b801a421e0b0c5 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.10.265 5.10.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.216 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.183 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.148 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.101 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.42 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.6 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"68425","cve":"CVE-2026-68425","epss":"0.002550000","percentile":"0.172310000","score_date":"2026-08-19","updated_at":"2026-08-20 00:13:09"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/infiniband/core/mad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"45416c87ebcece1e90f3bc5bc172d106b77c6b69","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"9634fb1f4d404f36a20ffbcb8797369db69b06bb","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"bfb9e8243fd2099d1080d09222964d988f991d9b","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"dfa535c94406c03d3f0c869ef3ba5528e395737c","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"98d2d468b4faa1fdc68c0c6c238389906ee3490c","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"ad9c9ad3204f63a46f0f7de29687a8e512f05e29","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"},{"lessThan":"d2e52d610b9b09694261632340b801a421e0b0c5","status":"affected","version":"fa619a77046bef30478697aba0553991033afb8e","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/infiniband/core/mad.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.13"},{"lessThan":"2.6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.265","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.216","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.183","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.148","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.101","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.42","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.10.265","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.216","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.183","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.148","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.101","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.42","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.6","versionStartIncluding":"2.6.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"2.6.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mad: Drop unmatched RMPP responses before reassembly\n\nKernel-handled RMPP receive processing starts reassembly for active\nDATA responses before the response is matched to an outstanding send.\nThe normal match happens later, after ib_process_rmpp_recv_wc() has\neither assembled a complete message or consumed the segment.\n\nThat ordering lets an unsolicited response that routes to a kernel\nRMPP agent by the high TID bits allocate or extend RMPP receive state\nbefore the full TID and source address are checked against a real\nrequest. A reordered burst can therefore reach the receive-side\ninsertion path even though the response would not match any send.\n\nFor kernel-handled RMPP DATA responses, require the existing\nib_find_send_mad() match before entering RMPP reassembly. The matcher\nalready checks the full TID, management class and source address/GID\nagainst the agent wait, backlog and in-flight send lists. If there is\nno match, drop the response without creating RMPP state.\n\nThis leaves the RMPP window behavior unchanged and only rejects\nresponses that have no corresponding request."}],"metrics":[{"cvssV3_1":{"baseScore":7.1,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:A - The attacker must be a node on the same InfiniBand fabric, sending unsolicited GSI (QP1) management datagrams to the victim port; MAD/SA traffic is subnet-local, matching the CVSS \"shared physical or logical network\" definition rather than routable network reach.\nAC:L - No race or unusual precondition is needed: the attacker just sends active RMPP DATA response MADs whose high TID bits name a kernel RMPP agent, and hi_tid is a small cyclic xarray index in [0,2^24) that is trivially enumerated or brute-forced.\nPR:N - The MAD receive path accepts unsolicited datagrams from any fabric peer with no authentication; the only gate is ib_mad_enforce_security() P_Key membership, which the default partition typically grants to every node on the subnet.\nUI:N - Reassembly state is created entirely from attacker-sent packets in the completion handler; no action by a local user or administrator is needed, and the always-registered ib_sa kernel agent is the target.\nS:U - The injected RMPP state, allocations and AH objects all live inside the kernel's own IB MAD layer on the same host, so the impact stays within a single security authority.\nC:N - The flaw creates unmatched reassembly state; it provides no out-of-bounds read, no kernel memory disclosure, and the ACKs the kernel emits echo only attacker-supplied header fields.\nI:L - An unauthenticated fabric peer can insert arbitrary unsolicited entries into the kernel agent's RMPP reassembly lists and make the kernel emit ACKs, and a colliding entry (SA TIDs come from a predictable tid++ counter) diverts and drops a legitimate SA response's segments — limited, bounded modification of kernel protocol state.\nA:H - Each unmatched segment allocates a mad_rmpp_recv, an AH and a retained ~1-2 KB MAD buffer held for 40 seconds with no matching request, so a burst causes unbounded memory/resource exhaustion, while the O(N) rmpp_list walks under an IRQ-disabled spinlock stall MAD processing and break SA/path resolution for the node."}]}],"providerMetadata":{"dateUpdated":"2026-08-19T16:35:19.996Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/45416c87ebcece1e90f3bc5bc172d106b77c6b69"},{"url":"https://git.kernel.org/stable/c/9634fb1f4d404f36a20ffbcb8797369db69b06bb"},{"url":"https://git.kernel.org/stable/c/bfb9e8243fd2099d1080d09222964d988f991d9b"},{"url":"https://git.kernel.org/stable/c/dfa535c94406c03d3f0c869ef3ba5528e395737c"},{"url":"https://git.kernel.org/stable/c/6e1bd7f590b0ccfee07f7fe1d48b92059bd37d72"},{"url":"https://git.kernel.org/stable/c/98d2d468b4faa1fdc68c0c6c238389906ee3490c"},{"url":"https://git.kernel.org/stable/c/ad9c9ad3204f63a46f0f7de29687a8e512f05e29"},{"url":"https://git.kernel.org/stable/c/d2e52d610b9b09694261632340b801a421e0b0c5"}],"title":"IB/mad: Drop unmatched RMPP responses before reassembly","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-68425","datePublished":"2026-08-10T12:04:45.947Z","dateReserved":"2026-07-30T09:28:09.392Z","dateUpdated":"2026-08-19T16:35:19.996Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-10 13:20:36","lastModifiedDate":"2026-08-19 17:20:49","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":7.1,"baseSeverity":"HIGH","attackVector":"ADJACENT_NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":4.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"68425","Ordinal":"1","Title":"IB/mad: Drop unmatched RMPP responses before reassembly","CVE":"CVE-2026-68425","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"68425","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nIB/mad: Drop unmatched RMPP responses before reassembly\n\nKernel-handled RMPP receive processing starts reassembly for active\nDATA responses before the response is matched to an outstanding send.\nThe normal match happens later, after ib_process_rmpp_recv_wc() has\neither assembled a complete message or consumed the segment.\n\nThat ordering lets an unsolicited response that routes to a kernel\nRMPP agent by the high TID bits allocate or extend RMPP receive state\nbefore the full TID and source address are checked against a real\nrequest. A reordered burst can therefore reach the receive-side\ninsertion path even though the response would not match any send.\n\nFor kernel-handled RMPP DATA responses, require the existing\nib_find_send_mad() match before entering RMPP reassembly. The matcher\nalready checks the full TID, management class and source address/GID\nagainst the agent wait, backlog and in-flight send lists. If there is\nno match, drop the response without creating RMPP state.\n\nThis leaves the RMPP window behavior unchanged and only rejects\nresponses that have no corresponding request.","Type":"Description","Title":"IB/mad: Drop unmatched RMPP responses before reassembly"}]}}}