CVE-2026-98216: IB/hfi1: Fix the PIO_CRED credit-return mmap

Published Oct 6, 2026

Updated

IB/hfi1: Fix the PIOCRED credit-return mmap

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 6, 2026

CVE Published

via MITRE·08:44 AM

Data Sourced

via MITRE·08:44 AM

Description

Data Sourced

via NVD·09:18 AM

Description

Oct 7, 2026

Data Sourced

via Microsoft·08:27 AM

DescriptionSeverityWeakness

Frequently Asked Questions

When does the faulty mapping occur?

It occurs when a hardware send context's credit-return entry is on the second or third page of the per-node allocation, which happens once the send context index reaches 64 or 128. Entries on the first page use a zero offset and work correctly, making the failure intermittent.

What action triggers the failure?

The failure is triggered when user space accesses the PIO_CRED mapping returned by hfi1_file_mmap(). The first user-space read of the incorrectly mapped page can cause the fault.

How might an affected system present the issue?

With an IOMMU, the invalid address may not belong to any vmalloc area, causing page lookup to return no pages and a frame above MAXPHYADDR to be installed. A subsequent user read can produce a "Corrupted page table" message, such as one associated with psm2_ep_open_pr.

CVE-2026-98216: IB/hfi1: Fix the PIO_CRED credit-return mmap

Affected Software

Event History

Frequently Asked Questions

When does the faulty mapping occur?

What action triggers the failure?

How might an affected system present the issue?

Company

Resources

Contact

Frequently Asked Questions

When does the faulty mapping occur?

What action triggers the failure?

How might an affected system present the issue?