CVE-2026-68425: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-68425 is a vulnerability in the Linux kernel's InfiniBand MAD (Management Datagram) subsystem where RMPP (Reliable Multi-Packet Protocol) receive processing begins reassembly of DATA responses before validating them against an outstanding send request. This flaw affects the Linux kernel from version 2.6.13 onward, with fixes backported to stable branches 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. The vulnerability was published on August 10, 2026, and a patch is available. The CVSS base score is currently estimated as Medium severity, with an ENISA-reported base score of 0.0 pending full scoring (GitHub Advisory, Feedly).

The root cause is improper input validation (related to CWE-20) in the kernel's ib_process_rmpp_recv_wc() function, which initiates RMPP reassembly for active DATA responses before matching them to an outstanding send request via ib_find_send_mad(). An attacker on the InfiniBand network can craft unsolicited RMPP DATA responses that are routed to a kernel RMPP agent based solely on high TID bits, causing the kernel to allocate or extend RMPP receive state without verifying the full TID, management class, and source address/GID against real requests. A reordered burst of such packets can reach the receive-side insertion path even without a corresponding request, enabling resource exhaustion. The fix enforces ib_find_send_mad() matching before entering RMPP reassembly, so unmatched responses are dropped without creating RMPP state (GitHub Advisory).

Successful exploitation allows a network-adjacent attacker to trigger unbounded memory allocation or kernel state corruption in the RMPP handler by sending crafted, unsolicited InfiniBand MAD DATA responses, potentially resulting in kernel resource exhaustion or a system crash (denial of service). Confidentiality and integrity impacts are not directly indicated; the primary risk is availability loss on systems with exposed InfiniBand interfaces. The scope is limited to hosts running vulnerable Linux kernel versions with active InfiniBand MAD agents (Feedly, GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date. The vulnerability requires network-adjacent access to an InfiniBand fabric and the ability to send crafted MAD packets, limiting the attacker surface to environments with exposed InfiniBand infrastructure. No threat actor attribution has been reported, and the CVE is not listed in the CISA KEV catalog. The EPSS score is 0.0, reflecting low current exploitation probability (Feedly, GitHub Advisory).

Apply the available kernel patches, which have been backported to the following stable releases: 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4. As a configuration-based workaround, restrict InfiniBand network access to trusted hosts only, using fabric management policies or network segmentation to limit exposure of MAD agents. Monitor kernel logs for RMPP-related errors or unusual memory pressure indicators as a detection measure until patching is complete (GitHub Advisory, Feedly).