CVE-2026-46182: Linux Kernel PAPR Hypervisor Pipe Information Disclosure Vulnerability

Technical summary

CVE-2026-46182 is a kernel information disclosure vulnerability in the pseries/papr-hvpipe driver. The vulnerability stems from incomplete initialization of a stack-allocated struct papr_hvpipe_hdr before it is copied to userspace via copy_to_user(). While the driver explicitly initializes the version and flags fields, the reserved padding bytes (reserved[3] and reserved2[40]) remain uninitialized and containing arbitrary kernel stack data. This uninitialized kernel memory is then exposed to userspace, violating confidentiality. The fix is straightforward: zero-initialize the entire structure before use to ensure no stale kernel data leaks through the padding.

Business impact

This information disclosure poses a moderate risk to systems running vulnerable Linux kernels on IBM POWER Systems hardware. Attackers with local user access can extract uninitialized kernel memory, which may contain sensitive data such as cryptographic keys, heap pointers for exploit development, or other kernel state information. While the vulnerability requires local access and does not directly enable privilege escalation or denial of service on its own, the leaked information could facilitate subsequent attacks. Organizations running POWER-based infrastructure (including IBM Power10, Power9, or virtualized environments) should treat this as a targeted concern requiring prompt remediation.

Affected systems

This vulnerability affects the Linux kernel on IBM POWER Systems (pseries architecture). It specifically impacts the papr-hvpipe (PAPR Hypervisor Pipe) driver, which is used for communication with the hypervisor on POWER-based systems. Any Linux distribution running on POWER Systems hardware with an affected kernel version is at risk. Server virtualization platforms and cloud deployments using POWER Systems architecture are in scope. Desktop or x86/ARM systems are not affected. Exact affected kernel versions should be verified against the Linux kernel security advisories and your distribution's patch tracking system.

Exploitability

Exploitation requires local access to the affected system, placing this in the 'low to moderate' exploitability category for most environments. The attack is trivial from a technical perspective—reading from the vulnerable driver requires no special kernel exploit techniques or race conditions. An unprivileged local user can trigger the information leak through normal driver interactions. However, practical impact depends on what kernel data happens to reside on the stack at the time of the copy, making the usefulness of each leak somewhat variable. This is not remotely exploitable and does not require kernel-level privileges, only user-level access.

Remediation

Apply the kernel patch that initializes the papr_hvpipe_hdr structure to zero before the copy_to_user() operation. This patch has been merged into the Linux kernel source tree. Affected users should update their kernel to a patched version. Check with your Linux distribution (Red Hat, SUSE, Canonical, or other POWER-aware vendors) for official kernel updates, as they typically backport security fixes to their supported kernel branches. Systems running unsupported or custom kernel versions should apply the upstream patch directly or upgrade to a supported distribution release with the fix applied.

Patch guidance

Obtain the patched kernel from your distribution's security update channel. For Red Hat Enterprise Linux and derivatives, check for kernel-devel and kernel package updates addressing CVE-2026-46182. For Ubuntu and Canonical systems, check Livepatch or standard kernel package updates. For SUSE and openSUSE, consult the SUSE Security Advisory associated with this CVE. Apply the patch and reboot the affected systems at your earliest convenience. Verify post-patch kernel version against the advisory to confirm the fix is in place. For custom or non-distribution kernels, obtain the fix from the upstream Linux kernel repository and apply it to your kernel source tree before rebuilding.

Detection guidance

Detection at runtime is difficult because the vulnerability is a silent information leak with no error messages or system-level indicators. Kernel-level auditing may log copy_to_user() calls from the papr-hvpipe driver, but this will not distinguish vulnerable from patched versions. The most practical detection approach is asset inventory verification: scan systems for kernel versions and POWER processor architecture, then cross-reference against the affected version ranges published by your distribution. Privileged monitoring of driver ioctl calls or sysfs exports from papr-hvpipe could provide heuristic signals in mature environments. Code review and static analysis of the driver source can confirm whether the vulnerability is present in a given kernel build.

Why prioritize this

While this vulnerability carries a MEDIUM CVSS score, it should not be treated as low-urgency. Information disclosure on POWER Systems infrastructure can facilitate sophisticated attacks. Prioritize this for systems that (1) run POWER architecture, (2) host sensitive workloads, (3) have untrusted local users, or (4) are in regulated industries requiring strict data confidentiality. For organizations without POWER Systems infrastructure, this is not relevant. For those with POWER deployments, include it in your next kernel patching cycle, ideally within 30-60 days depending on change management policies.

Risk score, explained

The CVSS v3.1 score of 5.5 (MEDIUM) reflects: Attack Vector Local (the attacker must be on the system), Attack Complexity Low (no special conditions required), Privileges Required Low (unprivileged user access is sufficient), User Interaction None, Scope Unchanged (impact is confined to the affected system), and Confidentiality Impact High (sensitive kernel memory is exposed). Integrity and Availability are rated as None because the vulnerability does not modify data or cause denial of service. The score appropriately reflects a localized information disclosure that is straightforward to exploit but limited in scope. Organizations with robust local access controls and low tolerance for information leaks may treat this as higher priority than the numerical score suggests.

Frequently asked questions