Incorrect Pointer Scaling in Linux kernel - CVE-2026-98216

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrect pointer scaling in the PIO_CRED case of hfi1_file_mmap() when mapping a credit-return page using a byte offset added to a struct credit_return pointer. A local user can map and read the affected credit-return page to cause a denial of service.

The erroneous offset occurs when the hardware send context index reaches 64 or 128. With IOMMU translation, the resulting mapping installs an invalid page-table entry, and the first user-space read triggers a kernel Oops.

Affected software

How to mitigate CVE-2026-98216

External References

• https://git.kernel.org/stable/c/180752deb7270ad37394ab6ef7cf4978fad040b3
• https://git.kernel.org/stable/c/535530bb2ea5254e1e9f55280143d262dd065204
• https://git.kernel.org/stable/c/62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101
• https://git.kernel.org/stable/c/bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b
• https://git.kernel.org/stable/c/dcebe0b0bb080a25fe08011fd6b6e741f7912f01

Related Security Bulletins

• Incorrect Pointer Scaling in Linux kernel hw hfi1 driver
• Debian update for linux