CVE-2026-68425

This is a temporal ordering vulnerability in the Linux kernel's InfiniBand Management Datagram (IB/mad) RMPP reassembly path. The bug: ib_process_rmpp_recv_wc() allocates or extends kernel RMPP receive state during reassembly before ib_find_send_mad() validates that a matching request actually exists. An attacker with positioning inside an IB fabric can send an unsolicited DATA response that triggers kernel state allocation based only on high TID bits before the full TID, MGMT class, and source GID validation completes. A reordered response burst exploits this window. The fix moves the match check earlier in the flow — a one-line reordering that relocates the security boundary, not just an operation sequence. The code was always correct in isolation; the failure is compositional, emerging only when messages arrive out of the expected order. This matters now because the RDMA attack surface has fundamentally changed. The IB/mad code path was written circa 2002 for isolated HPC clusters — an environment where an attacker inside the fabric was deprioritised. That assumption no longer holds. Cloud deployments with shared physical infrastructure, hypervisor-level RDMA access from VM escape paths, and RDMA-over-Converged-Ethernet bridging IB semantics onto accessible networks have all expanded reachability to this code path. The EPSS score of 0.00255 reflects current actor capability (few have fabric positioning), not severity or exploitability. What defenders should do: First, identify whether your kernels run the ib_mad module and handle IB fabric traffic. Second, verify the fix is applied — the commit moves ib_find_send_mad() before state allocation in the RMPP receive path. Third, if patching is delayed, monitor ib_mad transaction logs for TID mismatches where response state allocates without a corresponding request. Fourth, audit IB/RDMA exposure boundaries: any hypervisor or cloud node with RDMA hardware access is a potential entry point. Finally, treat this as a canary — if this forgotten 2002 code path has a temporal ordering flaw exposed by changed deployment contexts, the IB subsystem likely contains similar assumptions in other paths. Prioritise a targeted audit of RDMA message handling code for allocate-before-validate patterns.

Reviewed through automated stages and approved by a human before publication.