CVE-2026-98216: IB/hfi1: Fix the PIO_CRED credit-return mmap
IB/hfi1: Fix the PIOCRED credit-return mmap
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.158 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.112 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.54 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.8 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Correct the hfi1_file_mmap() PIO_CRED case to pass the base of the credit-return allocation with its full length to the DMA mapping API, select the context's page using vma->vm_pgoff, and treat cr_page_offset as a byte offset rather than struct credit_return* pointer arithmetic; keep memlen describing the VMA for the existing size check.
Event History
Frequently Asked Questions
When does the faulty mapping occur?
It occurs when a hardware send context's credit-return entry is on the second or third page of the per-node allocation, which happens once the send context index reaches 64 or 128. Entries on the first page use a zero offset and work correctly, making the failure intermittent.
What action triggers the failure?
The failure is triggered when user space accesses the PIO_CRED mapping returned by hfi1_file_mmap(). The first user-space read of the incorrectly mapped page can cause the fault.
How might an affected system present the issue?
With an IOMMU, the invalid address may not belong to any vmalloc area, causing page lookup to return no pages and a frame above MAXPHYADDR to be installed. A subsequent user read can produce a "Corrupted page table" message, such as one associated with psm2_ep_open_pr.