vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2022-49931

IB/hfi1: Correctly move list in sc_disable()

MEDIUM
5.5
CVSS Score
Published: May 1, 2025 at 02:11 PM UTC
Updated: August 5, 2026 at 09:24 AM UTC
1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM5.5
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Correctly move list in sc_disable() Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with sc_disable()") incorrectly tries to move a list from one list head to another. The result is a kernel crash. The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen: BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The fix is to use the correct call to move the list.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel· Linux
95%
v ≥ 5.14.165.10.77 ≤ v < 5.10.1545.14.16 ≤ v < 5.155.14.16 ≤ v < 5.15.785.15 ≤ v < 5.15.785.15 ≤ v < 6.0.85.15 ≤ v < 6.15.16 ≤ v < 6.0.85.4.157 ≤ v < 5.4.22413bac861952a78664907a0f927d3e874e9a590345.10.775.14.165.4.1575d33bd6b4d4d035e42733592899918a18f2540da6.1 rc16.1 rc26.1 rc3d98883f6c33e0d960afedcecaa92fc2b61fec383d997d4e4365f7e59cf6b59c70f966c56d704b64f
Vendor states this is fixed in 1afac08b39d85437187bb2a92d89a741b1078f55 (fixed)
Vendor states this is fixed in 25760a41e3802f54aadcc31385543665ab349b8e (fixed)
Vendor states this is fixed in 7c4260f8f188df32414a5ecad63e8b934c2aa3f0 (fixed)
Vendor states this is fixed in b8bcff99b07cc175a6ee12a52db51cdd2229586c (fixed)
Vendor states this is fixed in ba95409d6b580501ff6d78efd00064f7df669926 (fixed)
Vendor states this is fixed in 5.10.154 (unaffected)
Vendor states this is fixed in 5.15 (unaffected)
Vendor states this is fixed in 5.15.78 (unaffected)
Vendor states this is fixed in 5.4.224 (unaffected)
Vendor states this is fixed in 6.0.8 (unaffected)
Vendor states this is fixed in 6.1 (unaffected)

References (5)

Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/1afac08b39d85437187bb2a92d89a741b1078f55
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8e
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/b8bcff99b07cc175a6ee12a52db51cdd2229586c
Patch
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ba95409d6b580501ff6d78efd00064f7df669926

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.5MEDIUMCISA-ADP
Attack Vector
LOCAL
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-476

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card