CVE-2026-98216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/hfi1: Fix the PIO_CRED credit-return mmap

hfi1_file_mmap()'s PIO_CRED case must hand user space the single

credit-return page that holds this context's entry. That page is the

second or third page of the per-node credit-return allocation once the

hardware send context index reaches 64 or 128, so the failure below is

intermittent: when the entry lands on the first page the offset is zero

and everything works.

Two things are wrong.

First, cr_page_offset is a byte offset but .va is a struct

credit_return *, so adding it is pointer arithmetic and scales the offset

by sizeof(struct credit_return) == 64. memvirt then lands 256 KiB or

512 KiB past a 10240-byte allocation. With an IOMMU translating, that

address is inside the vmalloc range but in no vm_area, so

dma_mmap_coherent() -> iommu_dma_mmap() finds no pages, vmalloc_to_pfn()

returns page_to_pfn(NULL), and remap_pfn_range() installs a frame above

MAXPHYADDR.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References