EUVD-2026-93144
GHSA-2p8w-fgw9-p46c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access to hfi1 device
-
DeliveryOpen PSM2 endpoint reaching context index ≥64
-
ExploitTrigger faulty PIO_CRED mmap offset
-
ExecutionKernel maps invalid/wrong credit page
-
ImpactBad page-table Oops or permanent PIO hang
Vulnerability Assessment
| Exploitation Conditions | Requires LOCAL access to a system running the vulnerable Linux kernel hfi1 driver with Intel Omni-Path 100 HFI hardware present, and permission to open the hfi1 character device and invoke hfi1_file_mmap() with the PIO_CRED case (the PSM2 user path). The fault is INTERMITTENT and only manifests once the hardware send-context index reaches 64 or 128, so the credit-return entry lands on the second or third page of the per-node allocation; when the entry is on the first page (offset zero) the bug does not trigger. LIMITING FACTORS: no remote vector (AV:L), access to Omni-Path fabric hardware and its device node is mandatory (PR:L), the specialized hardware is not present in typical deployments, and triggering reliably requires enough active contexts to push the index past 64 - all of which sharply narrow realistic exposure. |
| Impact | This is a genuinely moderate, not high-priority, issue once all signals are weighed together. The input CVSS of 7.1 with vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H indicates a LOCAL vector requiring low privileges (PR:L) - i.e. a local user with access to the hfi1 Omni-Path character device - not remote exploitation, which immediately caps real-world exposure. EPSS is 0.18% (6th percentile), consistent with a local-only, hardware-dependent kernel driver bug that is hard to exploit at scale. The CVE is NOT in CISA KEV and no POC or exploit code is referenced, so there is no public exploit identified at time of analysis. The description's own evidence (reproducible kernel Oops 'Bad pagetable' and permanent send-PIO hang) strongly supports the A:H (availability/denial-of-service) rating as the dominant, confirmed impact. The C:H (confidentiality) rating assigned upstream is more debatable: the flaw hands user space the wrong credit-return page or a bogus physical frame - credit-return values are hardware flow-control counters of low sensitivity, so the realistic confidentiality impact appears lower than C:H suggests. CONFLICT TO NOTE: the 'Information Disclosure' tag and C:H metric emphasize data exposure, while the technical description centers on crashes and PIO stalls (availability); verify the intended primary impact with the kernel maintainers. Net: a real but low-urgency local DoS primarily affecting systems equipped with Intel Omni-Path hardware. |
| Exploit ScenarioDerived | A local user with permission to open the hfi1 Omni-Path device opens a PSM2 endpoint whose hardware send-context index reaches 64 or 128, triggering the faulty PIO_CRED mmap path. The corrupted credit-return mapping either Oopses the kernel with a bad page-table fault or silently points at another context's credit page, hanging all send-PIO traffic. No public exploit exists; the defect is reached through normal PSM2/Omni-Path usage rather than a crafted remote payload, and exploitation is local-only (AV:L) with low complexity (AC:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
RemediationAI
Upgrade to a vendor-released fixed kernel: 6.6.158, 6.12.112, 6.18.54, 7.2.8 or 7.3-rc4, which backport the corrected hfi1_file_mmap() logic via the git.kernel.org stable commits 535530bb2ea5254e1e9f55280143d262dd065204, dcebe0b0bb080a25fe08011fd6b6e741f7912f01, 180752deb7270ad37394ab6ef7cf4978fad040b3, bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b and 62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101; patching resolves both the page-table oops and the send-PIO stall. If immediate patching is not feasible, export PSM2_SDMA=2 in affected PSM2 applications to disable send PIO-the commit message confirms this mode completes normally because it avoids the broken mmap path-accepting higher latency and reduced throughput for the small messages that would otherwise use PIO. Because the trigger requires opening the hfi1 device node from a local account, restrict access to that node (for example via file permissions or a dedicated group) as a compensating control, recognizing that this does not fix the underlying bug and can break legitimate PSM2 workloads for users who are no longer authorized.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The hfi1 driver's hfi1_file_mmap() PIO_CRED case is supposed to map the single credit-return page that holds the calling context's entry within the per-node credit-return allocation. Two defects compound. First, cr_page_offset is a byte offset but is added to memvirt, which is a struct credit_return *, so the pointer arithmetic scales the offset by sizeof(struct credit_return) (64 bytes) and places memvirt 256 KiB or 512 KiB beyond a 10240-byte allocation; with an IOMMU translating, that address falls inside the vmalloc range but in no vm_area, so dma_mmap_coherent() → iommu_dma_mmap() finds no pages, vmalloc_to_pfn() returns page_to_pfn(NULL), and remap_pfn_range() installs a frame above MAXPHYADDR, producing the 'Bad pagetable' oops on the first user read. Second, dma_mmap_coherent() describes a whole coherent buffer and selects the page within it using vma->vm_pgoff, so offsetting cpu_addr has no effect on a vmap'd allocation-iommu_dma_mmap() uses cpu_addr only to locate the vm_area and then maps pages[vm_pgoff], which the driver has just set to 0. As a result, user space always receives the first credit-return page, every credit read is for the wrong context, and send PIO stalls indefinitely. The fix passes the base of the allocation with its full length and selects the page via vm_pgoff, keeping a separate length because memlen must still describe the VMA for the existing size check; the dma-direct path remains correct because dma_direct_mmap() adds the same vm_pgoff to the base pfn. Reproduction required Intel IOMMU in DMA-FQ mode on Omni-Path 100 hardware, and the commit message confirms that with only the arithmetic corrected send PIO still hangs while PSM2_SDMA=2 completes normally.
Know when Dell gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Local device access with low privileges (AV:L/PR:L); confirmed kernel crash/PIO hang drives A:H, while cross-context credit-page exposure is low-sensitivity so C:L rather than C:H.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
IB/hfi1: Fix the PIO_CRED credit-return mmap
hfi1_file_mmap()'s PIO_CRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return allocation once the hardware send context index reaches 64 or 128, so the failure below is intermittent: when the entry lands on the first page the offset is zero and everything works.
Two things are wrong.
First, cr_page_offset is a byte offset but .va is a struct credit_return *, so adding it is pointer arithmetic and scales the offset by sizeof(struct credit_return) == 64. memvirt then lands 256 KiB or 512 KiB past a 10240-byte allocation. With an IOMMU translating, that address is inside the vmalloc range but in no vm_area, so dma_mmap_coherent() -> iommu_dma_mmap() finds no pages, vmalloc_to_pfn() returns page_to_pfn(NULL), and remap_pfn_range() installs a frame above MAXPHYADDR. The first user read then takes:
psm2_ep_open_pr: Corrupted page table at address 7a14d007e000 PGD 800000013886a067 P4D 800000013886a067 PUD 13886b067 PMD 13886c067 PTE 800049168e911235 Oops: Bad pagetable: 000d [#1] SMP PTI
Second, and still wrong once the arithmetic is corrected, dma_mmap_coherent() describes a whole coherent buffer and selects the page within it with vma->vm_pgoff. Offsetting cpu_addr has no effect: for a vmap'd allocation iommu_dma_mmap() uses cpu_addr only to locate the vm_area and then maps pages[vm_pgoff], which hfi1_file_mmap() has just set to 0. User space therefore always receives the first credit-return page, every credit read is for the wrong context, and send PIO stalls forever.
Use the DMA API as intended: pass the base of the allocation with its full length and select the page with vm_pgoff. A separate length is needed because memlen must keep describing the VMA for the existing size check. The dma-direct path stays correct as well, since dma_direct_mmap() adds the same vm_pgoff to the base pfn.
Tested on a Dell T7610 (Xeon E5-2650 v2, Intel IOMMU in DMA-FQ mode) against a Threadripper PRO 3995WX peer, both Omni-Path 100. Before this change psm2_ep_open() Oopses the kernel; with only the arithmetic corrected psm2_ep_open() succeeds but any transfer that uses send PIO hangs, PSM2_SDMA=2 (send PIO disabled) completing normally while PSM2_SDMA=0 (send PIO only) hangs every time. With this change send PIO, send DMA and the default mixed mode all work.
Executive ViewAI
A flaw in the Linux kernel's Intel Omni-Path (hfi1) driver can crash a host with a corrupted page-table fault or permanently stall outbound send-PIO transfers, forcing a reboot or degrading message throughput on affected nodes. Exposure is confined to high-performance computing hosts running kernel 6.3 or later with the hfi1 driver, Intel Omni-Path 100 hardware, and the PSM2 stack, and triggering it requires local access to the HFI character device plus a specific intermittent send-context condition. Because the vendor has already published fixes, leadership should treat this as a scheduled maintenance item for the HPC fleet rather than an emergency incident.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2
The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before 7.2 SP2, SonicWALL Analyzer before
The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default passwor
Multiple SQL injection vulnerabilities in Dell SonicWall Scrutinizer 11.0.1 allow remote authenticated users to execute
Dell RecoverPoint for Virtual Machines prior to 6.0.3.1 HF1 contains hardcoded credentials (CVE-2026-22769, CVSS 10.0) t
An unrestricted file upload vulnerability exists in Dell (acquired by Quest) KACE K1000 System Management Appliance vers
cgi-bin/admin.cgi in the web console in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.0 does not requir
The IPMI 1.5 functionality in Dell iDRAC6 modular before 3.65, iDRAC6 monolithic before 1.98, and iDRAC7 before 1.57.57
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabi
The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerabili
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection
Exploit-DB