Function Call with Incorrectly Specified Arguments in Linux kernel - CVE-2026-98216

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to incorrectly specified DMA mapping arguments in the PIO_CRED case of hfi1_file_mmap() when selecting a credit-return page with an offset buffer address and a zero page offset. A local user can map the wrong credit-return page and initiate transfers using send PIO to cause a denial of service.

For an IOMMU-backed, virtually mapped allocation, the issue affects contexts whose credit-return entries reside on the second or third page. Transfers using send PIO stall indefinitely, while send-DMA-only transfers remain operational.

Affected software

How to mitigate CVE-2026-98216

External References

• https://git.kernel.org/stable/c/180752deb7270ad37394ab6ef7cf4978fad040b3
• https://git.kernel.org/stable/c/535530bb2ea5254e1e9f55280143d262dd065204
• https://git.kernel.org/stable/c/62f0f34fbd2b2d5653d33d3b9d42fdcabb1c0101
• https://git.kernel.org/stable/c/bafeac9ce5d1ce5256bcf7e5702e831e9aaf419b
• https://git.kernel.org/stable/c/dcebe0b0bb080a25fe08011fd6b6e741f7912f01

Related Security Bulletins

• Function Call with Incorrectly Specified Arguments in Linux kernel hw hfi1 driver
• Debian update for linux