CVE-2026-46118: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46118 Overview

CVE-2026-46118 is a null pointer dereference vulnerability in the Linux kernel's pseries papr-hvpipe driver. The flaw resides in the papr_hvpipe_dev_create_handle() function on PowerPC pSeries systems. A prior refactor that converted the create handle path to FD_PREPARE() reused src_info after a call to retain_and_null_ptr(src_info), leading to a kernel NULL pointer write when adding the structure to the global list. Triggering the issue produces a kernel panic via the papr_hvpipe_dev_ioctl path, resulting in denial of service on affected pSeries kernels [CWE-476].

Critical Impact
Local invocation of the papr_hvpipe ioctl can trigger a kernel NULL pointer dereference, panicking the system and causing denial of service.

Affected Products

Linux kernel builds for IBM PowerPC pSeries (pseries/papr-hvpipe)
Kernel versions including commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()")
Distributions shipping the affected kernel without backported fixes

Discovery Timeline

2026-05-28 - CVE-2026-46118 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46118

Vulnerability Analysis

The papr-hvpipe driver exposes an ioctl interface on IBM pSeries systems for hypervisor pipe communication. The function papr_hvpipe_dev_create_handle() was refactored to use FD_PREPARE() for file descriptor preparation. After the refactor, src_info is passed to retain_and_null_ptr(src_info), which transfers ownership and nulls the local pointer. The code then dereferences the same src_info pointer to insert it into the global list, writing to address 0x00000000.

The kernel log shows the fault originating from papr_hvpipe_dev_ioctl+0x1f4/0x48c, reached via sys_ioctl and the system call exception path. Any local caller with access to the papr-hvpipe character device can reach this code path and panic the kernel.

Root Cause

The root cause is improper handling of pointer lifetime after retain_and_null_ptr(). The macro nulls the source pointer to prevent automatic __free(kfree) cleanup, but subsequent code continues to use the now-null local variable. The fix restructures the function to allocate and prepare src_info early, then insert it into the global list under a spinlock after a duplicate check, simplifying error handling and eliminating the unsafe pointer reuse.

Attack Vector

Exploitation requires local access and the ability to issue ioctls against the papr-hvpipe device on a pSeries guest. The condition is reached through standard ioctl() system calls and does not require network access or elevated privileges beyond device access. The result is a kernel oops and panic — a denial of service — rather than memory corruption usable for code execution, because the write targets a NULL address.

No verified public exploit code is available. The upstream commit message includes the panic trace demonstrating the crash path. See the kernel.org stable commit for the fix.

Detection Methods for CVE-2026-46118

Indicators of Compromise

Kernel oops messages referencing Kernel NULL pointer dereference on write at 0x00000000 with the faulting function papr_hvpipe_dev_create_handle
Call traces containing papr_hvpipe_dev_ioctl+0x1f4/0x48c followed by sys_ioctl and system_call_exception
Unexpected pSeries guest reboots or panics correlated with userspace processes opening the papr-hvpipe device

Detection Strategies

Inventory pSeries Linux guests and compare running kernel versions against the fixed commits 1b9f7aafa44f, 735439394dde, and cf51bec1560f
Audit which userspace processes hold file descriptors against the papr-hvpipe character device on production hosts
Review crash dumps and kdump artifacts for stack traces matching the papr_hvpipe_dev_ioctl path

Monitoring Recommendations

Forward /var/log/messages, dmesg, and kernel.panic events to a central log platform and alert on papr_hvpipe symbol names
Monitor pSeries guest availability metrics for unscheduled reboot patterns
Track ioctl activity against /dev/papr-hvpipe (or equivalent) using auditd rules tied to the device inode

How to Mitigate CVE-2026-46118

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 1b9f7aafa44f, 735439394dde, and cf51bec1560f once available in your distribution
Restrict access to the papr-hvpipe device node to trusted system services only
Reboot pSeries guests onto patched kernels during the next maintenance window

Patch Information

The fix reworks papr_hvpipe_dev_create_handle() to allocate and prepare src_info upfront, then add it to the global list under a spinlock after a duplicate check, before calling FD_ADD. If FD_ADD fails, the cleanup path removes src_info from the list and drains any pending hvpipe messages. Patches are available in the stable kernel tree:

Workarounds

Where the papr-hvpipe functionality is not required, blacklist or unload the driver to remove the vulnerable ioctl path
Apply strict file permissions and SELinux/AppArmor policy on the papr-hvpipe device to limit local access
Avoid running untrusted local workloads on pSeries guests until patched kernels are deployed

bash

# Confirm running kernel and check for the papr-hvpipe driver on pSeries
uname -r
lsmod | grep -i papr_hvpipe

# Restrict device access (example - adjust device path to match your system)
ls -l /dev/papr-hvpipe 2>/dev/null
chmod 600 /dev/papr-hvpipe 2>/dev/null

# After patching, reboot and confirm fixed commit is present
dmesg | grep -i papr_hvpipe