Linux kernel (drivers/infiniband/hw/hfi1): The driver drops the last reference on a process's memory-descriptor

CVSS 7.8CVE-2022-49076Firmware, BMC & network fabriccurated

Impact

The driver drops the last reference on a process's memory-descriptor structure and then keeps using it while unpinning pages. A newly started process can be handed that same structure, so one tenant's cleanup corrupts another running task's address-space state - the reported symptoms include a mangled mmap lock leading to a system-wide hang.

Who can reach it

A tenant with the hfi1 character device in its container, doing pinned-memory RDMA (typical MPI workload), that exits or aborts abruptly while page unpinning is still in flight - an MPI_Abort is the documented trigger, so the tenant controls the timing. Requires hfi1 hardware (Intel Omni-Path).

What to do

Update to 5.10 or later per the record, or apply the listed stable commits on your branch. Interim: keep the hfi1 device node out of untrusted containers; there is no runtime toggle that closes the race.

References

https://git.kernel.org/stable/c/5f54364ff6cfcd14cddf5441c4a490bb28dd69f7 https://git.kernel.org/stable/c/9ca11bd8222a612de0d2f54d050bfcf61ae2883f https://nvd.nist.gov/vuln/detail/CVE-2022-49076

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.