CVE-2026-68425

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the kernel-handled RMPP receive processing where reassembly for active DATA responses begins before the response is matched to an outstanding send. This ordering allows unsolicited responses routing to a kernel RMPP agent via high TID bits to allocate or extend RMPP receive state before the full TID and source address are verified against a real request. Consequently, a reordered burst can reach the receive-side insertion path despite not matching any send. The ib process rmpp recv wc() function handles the reassembly, while ib find send mad() is used for matching the TID, management class, and source address/GID.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.