Linux kernel (drivers/infiniband/hw/hfi1): The node panics when the fabric link goes down while any sender is waiting

CVSS 8.8CVE-2022-49931Firmware, BMC & network fabriccurated

Impact

The node panics when the fabric link goes down while any sender is waiting for send credits. A corrupted list move in the freeze path dereferences a bad pointer in a workqueue, so a single link event turns into a whole-node outage for every tenant on that host - and the CNA rates it as giving confidentiality and integrity impact, not just availability.

Who can reach it

Adjacent-network: anyone able to bounce the Omni-Path link reaches it - a port flap, a switch-side action, a peer resetting the port, or a cable event. No credentials on the host are required and no tenant device node is needed; the trigger is the link transition itself while send waiters are queued. Requires hfi1 hardware (Intel Omni-Path), so this matters on HPC-heritage fabric nodes rather than pure Ethernet/RoCE clusters.

What to do

Update to 5.4.224, 5.10.154, 5.15 or later. There is no useful interim control - the trigger is a normal fabric event, so schedule the reboot rather than trying to gate access.

References

https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8e https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0 https://nvd.nist.gov/vuln/detail/CVE-2022-49931

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.