CVE-2022-49931: 
Linux Kernel vulnerability analysis and mitigation

A vulnerability in the Linux kernel's IB/hfi1 component (CVE-2022-49931) was identified, involving an incorrect list movement implementation in the sc_disable() function. The issue was introduced by commit 13bac861952a which attempted to fix an ABBA locking issue. The vulnerability was disclosed on May 1, 2025 (NVD Database).

The vulnerability stems from an incorrect attempt to move a list from one list head to another in the sc_disable() function. When triggered, it results in a kernel NULL pointer dereference at address 0x30. The issue manifests specifically when a link goes down and there are waiters for a send completion. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (NVD Database).

When exploited, this vulnerability causes a kernel crash, leading to system instability and potential denial of service conditions. The crash is specifically triggered during link down conditions with pending send completion waiters (Wiz Analysis).

The vulnerability has been resolved by implementing the correct call to move the list in the sc_disable() function. A fix has been developed and incorporated into the Linux kernel through various patches (Wiz Analysis).