HighFix available
IB/hfi1: Correctly move list in sc_disable()
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Correctly move list in sc_disable() Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with sc_disable()") incorrectly tries to move a list from one list head to another. The result is a kernel crash. The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen: BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The fix is to use the correct call to move the list.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.154, 5.15.78, 5.4.224, 6.0.8
- CVEs
- CVE-2022-49931
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 08:08 UTC · Revision 1
Source evidence
IB/hfi1: Correctly move list in sc_disable()
core-osv · Original sourcePublished 1 May 2025, 14:11 UTC
In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Correctly move list in sc_disable() Commit 13bac861952a ("IB/hfi1: Fix abba locking issue with sc_disable()") incorrectly tries to move a list from one list head to another. The result is a kernel crash. The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen: BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The fix is to use the correct call to move the list.
osv:CVE-2022-49931
Kernel
Fixed versions: 5.4.224, 5.10.154, 5.15.78, 6.0.8
Complete source record
{
"id": "4b2ce91905543b62c982881e4153e465b18e5e7aaae7c823c298542304bcb6c9",
"url": "https://osv.dev/vulnerability/CVE-2022-49931",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "IB/hfi1: Correctly move list in sc_disable()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Correctly move list in sc_disable() Commit 13bac861952a (\"IB/hfi1: Fix abba locking issue with sc_disable()\") incorrectly tries to move a list from one list head to another. The result is a kernel crash. The crash is triggered when a link goes down and there are waiters for a send to complete. The following signature is seen: BUG: kernel NULL pointer dereference, address: 0000000000000030 [...] Call Trace: sc_disable+0x1ba/0x240 [hfi1] pio_freeze+0x3d/0x60 [hfi1] handle_freeze+0x27/0x1b0 [hfi1] process_one_work+0x1b0/0x380 ? process_one_work+0x380/0x380 worker_thread+0x30/0x360 ? process_one_work+0x380/0x380 kthread+0xd7/0x100 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x1f/0x30 The fix is to use the correct call to move the list.",
"evidence": "osv:CVE-2022-49931",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.4.224",
"evidence": "/affected/1/ranges"
},
{
"value": "5.10.154",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.78",
"evidence": "/affected/1/ranges"
},
{
"value": "6.0.8",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2022-49931",
"aliases": [
"CVE-2022-49931"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d997d4e4365f7e59cf6b59c70f966c56d704b64f"
},
{
"fixed": "25760a41e3802f54aadcc31385543665ab349b8e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "d98883f6c33e0d960afedcecaa92fc2b61fec383"
},
{
"fixed": "7c4260f8f188df32414a5ecad63e8b934c2aa3f0"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "13bac861952a78664907a0f927d3e874e9a59034"
},
{
"fixed": "ba95409d6b580501ff6d78efd00064f7df669926"
},
{
"fixed": "b8bcff99b07cc175a6ee12a52db51cdd2229586c"
},
{
"fixed": "1afac08b39d85437187bb2a92d89a741b1078f55"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.157"
},
{
"fixed": "5.4.224"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.77"
},
{
"fixed": "5.10.154"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.14.16"
},
{
"fixed": "5.15"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5d33bd6b4d4d035e42733592899918a18f2540da"
}
]
}
],
"versions": [
"v5.4.223",
"v5.4.222",
"v5.4.221",
"v5.4.220",
"v5.4.219",
"v5.4.218",
"v5.4.217",
"v5.4.216",
"v5.4.215",
"v5.4.214",
"v5.4.213",
"v5.4.212",
"v5.4.211",
"v5.4.210",
"v5.4.209",
"v5.4.208",
"v5.4.207",
"v5.4.206",
"v5.4.205",
"v5.4.204",
"v5.4.203",
"v5.4.202",
"v5.4.201",
"v5.4.200",
"v5.4.199",
"v5.4.198",
"v5.4.197",
"v5.4.196",
"v5.4.195",
"v5.4.194",
"v5.4.193",
"v5.4.192",
"v5.4.191",
"v5.4.190",
"v5.4.189",
"v5.4.188",
"v5.4.187",
"v5.4.186",
"v5.4.185",
"v5.4.184",
"v5.4.183",
"v5.4.182",
"v5.4.181",
"v5.4.180",
"v5.4.179",
"v5.4.178",
"v5.4.177",
"v5.4.176",
"v5.4.175",
"v5.4.174",
"v5.4.173",
"v5.4.172",
"v5.4.171",
"v5.4.170",
"v5.4.169",
"v5.4.168",
"v5.4.167",
"v5.4.166",
"v5.4.165",
"v5.4.164",
"v5.4.163",
"v5.4.162",
"v5.4.161",
"v5.4.160",
"v5.4.159",
"v5.4.158",
"v5.4.157",
"v5.10.153",
"v5.10.152",
"v5.10.151",
"v5.10.150",
"v5.10.149",
"v5.10.148",
"v5.10.147",
"v5.10.146",
"v5.10.145",
"v5.10.144",
"v5.10.143",
"v5.10.142",
"v5.10.141",
"v5.10.140",
"v5.10.139",
"v5.10.138",
"v5.10.137",
"v5.10.136",
"v5.10.135",
"v5.10.134",
"v5.10.133",
"v5.10.132",
"v5.10.131",
"v5.10.130",
"v5.10.129",
"v5.10.128",
"v5.10.127",
"v5.10.126",
"v5.10.125",
"v5.10.124",
"v5.10.123",
"v5.10.122",
"v5.10.121",
"v5.10.120",
"v5.10.119",
"v5.10.118",
"v5.10.117",
"v5.10.116",
"v5.10.115",
"v5.10.114",
"v5.10.113",
"v5.10.112",
"v5.10.111",
"v5.10.110",
"v5.10.109",
"v5.10.108",
"v5.10.107",
"v5.10.106",
"v5.10.105",
"v5.10.104",
"v5.10.103",
"v5.10.102",
"v5.10.101",
"v5.10.100",
"v5.10.99",
"v5.10.98",
"v5.10.97",
"v5.10.96",
"v5.10.95",
"v5.10.94",
"v5.10.93",
"v5.10.92",
"v5.10.91",
"v5.10.90",
"v5.10.89",
"v5.10.88",
"v5.10.87",
"v5.10.86",
"v5.10.85",
"v5.10.84",
"v5.10.83",
"v5.10.82",
"v5.10.81",
"v5.10.80",
"v5.10.79",
"v5.10.78",
"v5.10.77",
"v5.14.21",
"v5.14.20",
"v5.14.19",
"v5.14.18",
"v5.14.17",
"v5.14.16"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49931.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.4.224"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.5.0"
},
{
"fixed": "5.10.154"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.78"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.15.0"
},
{
"fixed": "6.0.8"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-49931.json"
}
}
],
"modified": "2026-10-28T02:30:27.110065224Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/1afac08b39d85437187bb2a92d89a741b1078f55",
"https://git.kernel.org/stable/c/25760a41e3802f54aadcc31385543665ab349b8e",
"https://git.kernel.org/stable/c/7c4260f8f188df32414a5ecad63e8b934c2aa3f0",
"https://git.kernel.org/stable/c/b8bcff99b07cc175a6ee12a52db51cdd2229586c",
"https://git.kernel.org/stable/c/ba95409d6b580501ff6d78efd00064f7df669926",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49931.json",
"https://nvd.nist.gov/vuln/detail/CVE-2022-49931",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/49xxx/CVE-2022-49931.json"
}
},
"related_cves": [
{
"value": "CVE-2022-49931",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 493642,
"published_at": "2025-05-01T14:11:08.135+00:00"
}