CVE-2026-46118

Technical summary

CVE-2026-46118 is a null pointer dereference vulnerability in the pseries/papr-hvpipe Linux kernel driver, specifically in the papr_hvpipe_dev_create_handle() function. A prior commit (6d3789d347a7) converted the handle creation to use the FD_PREPARE() macro for file descriptor allocation. However, the refactoring introduced a use-after-clear bug: the src_info structure is nullified by retain_and_null_ptr(src_info), but the function then attempts to add this same structure to a global linked list, dereferencing a null pointer in the process. The kernel panic occurs when the function tries to perform list operations on the invalidated src_info pointer. The fix involves pre-allocating and list-insertion of src_info under spinlock protection before FD_ADD operations, with proper error unwinding to remove the structure from the list if subsequent operations fail.

Business impact

This vulnerability enables a denial-of-service attack affecting systems running the Linux kernel with the PAPR hypervisor pipe driver (primarily IBM POWER-based platforms). An unprivileged local user can crash the kernel by invoking the vulnerable ioctl, causing unplanned downtime and service interruption. For environments where multiple tenants or containers share a POWER-based Linux host, a single malicious or misconfigured user can destabilize the entire system. Recovery requires manual system reboot, impacting availability and potentially triggering SLA violations.

Affected systems

The vulnerability affects the Linux kernel across versions that include the papr-hvpipe driver, specifically those containing the problematic FD_PREPARE() refactoring. PAPR (PowerPC Architecture Platform Requirements) hypervisor pipe support is present primarily in Linux distributions and kernels running on IBM POWER9 and POWER10 processor-based systems. Standard x86-64, ARM, and other non-POWER architectures are not affected. Verify your kernel configuration for CONFIG_PPC_PAPR_HVPIPE to determine exposure.

Exploitability

The vulnerability requires local access and the ability to invoke ioctl system calls on papr-hvpipe devices. Attack complexity is low—the crash is reliably triggered by normal ioctl calls attempting to create a device handle. No special capabilities beyond standard user privileges are needed, though in many deployments access to the hvpipe device may be restricted by file permissions or cgroups. The vulnerability is not remotely exploitable and does not allow privilege escalation or data compromise; impact is limited to availability.

Remediation

Apply the upstream Linux kernel patch that restructures the handle creation logic. The fix reallocates src_info at the start of the function, adds it to the global list under spinlock protection before FD_ADD operations, and implements corrected error handling to remove src_info from the list if FD_ADD fails. For enterprises, obtain and deploy a stable kernel update from your distributor (Red Hat, Ubuntu, SUSE, etc.) that includes the fix. Interim mitigation is possible by restricting device access via file permissions or SELinux policies, though this may impact legitimate applications using hvpipe.

Patch guidance

Verify the patch against your Linux distribution's advisory. The upstream fix modifies the allocation and error-handling flow in papr_hvpipe_dev_create_handle(); it is not a simple line revert but a restructuring of initialization and cleanup logic. Update to a kernel version confirmed to contain the corrected implementation. Test in a staging environment with PAPR-dependent workloads (if applicable) to confirm functionality before production deployment. Check your vendor's kernel security update channels for CVE-2026-46118 references.

Detection guidance

Monitor kernel logs for papr_hvpipe-related oops messages, particularly those showing null pointer dereference at address 0x00000000 with Faulting Instruction Address near papr_hvpipe code regions. Intrusion Detection Systems can flag ioctl(2) calls targeting /dev/hvpipe* by unprivileged processes if device policies do not normally permit them. Audit-daemon rules can log failed or suspicious device interactions. However, on vulnerable unpatched systems, legitimate crash events are indistinguishable from exploit attempts without correlation with application or workload context. Prioritize patching over detection-based responses.

Why prioritize this

Patch this within your regular update cycle if you operate POWER-based systems running Linux with PAPR hvpipe support. While the CVSS score is moderate (5.5), the reliability of the crash, low barrier to exploitation, and potential for multi-tenant environments mean this should not be deferred indefinitely. However, it is not an emergency for x86-64-dominated infrastructure. Tier your response by platform: urgent for POWER deployment, standard-priority for mixed environments where POWER systems are present.

Risk score, explained

CVSS 3.1 score of 5.5 (Medium) reflects: attack vector local only (reduces score), low attack complexity (increases score), low privileges required (increases score), high availability impact—denial of service via kernel crash (primary driver), and no confidentiality or integrity impact. The score appropriately captures that this is a localized DoS without data exposure or privilege escalation. However, context matters: in large multi-tenant POWER clusters, the blast radius and remediation burden elevate practical risk beyond the numeric score.

Frequently asked questions