The vulnerability originates from incorrect pointer arithmetic in the hfi1_file_mmap() handler within the Linux kernel. The code interprets a byte offset as a struct pointer offset, scaling it by sizeof(struct credit_return). This results in the kernel mapping a memory page far beyond the allocated buffer, causing a page table corruption and an Oops exception. The kernel panic leads to a denial of service, disabling I/O operations for OmniPath devices. The weakness is improper pointer manipulation.

All Linux kernel builds that contain the hfi1 driver before the patch commit. The problem exists regardless of distribution and kernel configuration, affecting users running Omni‑Path hardware. No specific version range is listed, so any stock kernel with the OMNI‑Path RMIC interface is potentially impacted.

The CVE description does not describe a remote exploitation path. However, the bug requires that an attacker trigger the hfi1_file_mmap() path in the kernel, which typically implies local code execution or privilege elevation to load or invoke a module. This is an inference based on the need to access the vulnerable code. If such a condition is met, the fault causes a kernel panic, leading to a DoS for Omni‑Path devices. The CVSS score of 7.1 indicates a high severity, and the EPSS score remains less than 1%, with the vulnerability not listed in KEV, suggesting limited public exploitation. Nevertheless, any environment using Omni‑Path hardware should apply the patch immediately to prevent crashes that could interrupt service.