CVE-2022-49931

IB/hfi1: Correctly move list in sc_disable()

State: Published
Severity: 8.8 High
Published: May 1, 2025
Updated: Aug 5, 2026
Reserved: May 1, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

IB/hfi1: Correctly move list in sc_disable()

Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with sc_disable()") incorrectly tries to move a list from one list head to another. The result is a kernel crash.

The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen:

BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30

The fix is to use the correct call to move the list.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	d997d4e4365f7e59cf6b59c70f966c56d704b64f to before 25760a41e3802f54aadcc31385543665ab349b8eAffected d98883f6c33e0d960afedcecaa92fc2b61fec383 to before 7c4260f8f188df32414a5ecad63e8b934c2aa3f0Affected 13bac861952a78664907a0f927d3e874e9a59034 to before ba95409d6b580501ff6d78efd00064f7df669926Affected 13bac861952a78664907a0f927d3e874e9a59034 to before b8bcff99b07cc175a6ee12a52db51cdd2229586cAffected 13bac861952a78664907a0f927d3e874e9a59034 to before 1afac08b39d85437187bb2a92d89a741b1078f55Affected 5d33bd6b4d4d035e42733592899918a18f2540daAffected 5.4.157 to before 5.4.224Affected 5.10.77 to before 5.10.154Affected 5.14.16 to before 5.15Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.4.224 through 5.4.Not affected 5.10.154 through 5.10.Not affected 5.15.78 through 5.15.Not affected 6.0.8 through 6.0.Not affected 6.1 and laterNot affected

Product

Versions

LinuxLinux

d997d4e4365f7e59cf6b59c70f966c56d704b64f to before 25760a41e3802f54aadcc31385543665ab349b8eAffected
d98883f6c33e0d960afedcecaa92fc2b61fec383 to before 7c4260f8f188df32414a5ecad63e8b934c2aa3f0Affected
13bac861952a78664907a0f927d3e874e9a59034 to before ba95409d6b580501ff6d78efd00064f7df669926Affected
13bac861952a78664907a0f927d3e874e9a59034 to before b8bcff99b07cc175a6ee12a52db51cdd2229586cAffected
13bac861952a78664907a0f927d3e874e9a59034 to before 1afac08b39d85437187bb2a92d89a741b1078f55Affected
5d33bd6b4d4d035e42733592899918a18f2540daAffected
5.4.157 to before 5.4.224Affected
5.10.77 to before 5.10.154Affected
5.14.16 to before 5.15Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.4.224 through 5.4.*Not affected
5.10.154 through 5.10.*Not affected
5.15.78 through 5.15.*Not affected
6.0.8 through 6.0.*Not affected
6.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.