CVE-2026-46298: Linux Kernel Race Condition Vulnerability

CVE-2026-46298 Overview

CVE-2026-46298 is a race condition in the Linux kernel's pseries/papr-hvpipe driver for IBM POWER systems. The flaw occurs when an interrupt fires on the same CPU that is currently executing the driver's ->ioctl or ->release handler. Because both paths attempt to acquire the same lock without disabling interrupts, the kernel can enter a deadlock. The upstream fix converts the affected paths to use spin_lock_irqsave and spin_lock_irqrestore to prevent the re-entrant acquisition.

Critical Impact
A local process interacting with the papr-hvpipe character device can trigger a CPU deadlock, resulting in a denial-of-service condition on affected pseries (PowerPC) Linux systems.

Affected Products

Linux kernel versions containing the pseries/papr-hvpipe driver
IBM PowerPC pseries (PAPR) platforms using HVPIPE
Distributions shipping the affected kernel prior to the referenced stable commits

Discovery Timeline

2026-06-08 - CVE-2026-46298 published to the National Vulnerability Database
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-46298

Vulnerability Analysis

The issue is a self-deadlock [Deadlock] in the PAPR (Power Architecture Platform Reference) HVPIPE driver under arch/powerpc/platforms/pseries. The driver exposes a character device with ->ioctl and ->release file operations that acquire an internal spinlock. The same lock is also taken by the device's interrupt handler. When user space invokes ioctl or closes the device, the handler holds the lock with interrupts still enabled. If the HVPIPE interrupt is delivered to the same CPU during that window, the interrupt handler attempts to re-acquire the lock that the preempted task already owns, producing a classic lock-against-interrupt deadlock.

Root Cause

The ->ioctl and ->release paths used non-IRQ-safe locking primitives such as spin_lock/spin_unlock while sharing a lock with an interrupt context. Linux requires that any lock taken from both process context and interrupt context use the _irqsave/_irqrestore variants, which disable local interrupts during the critical section. The original code did not, leaving a race window on the CPU running the syscall.

Attack Vector

The vulnerability is reachable from local user space with access to the HVPIPE device node. An unprivileged or privileged process performing ioctl() or close() calls while HVPIPE interrupts arrive can hang the CPU. Remote exploitation is not described in the advisory, and there is no evidence of public exploit code or in-the-wild abuse. See the Kernel Git Commit Overview and Kernel Git Commit Details for the exact code paths modified.

// No verified proof-of-concept code is published for this CVE.
// Refer to the upstream commits for the precise locking changes.

Detection Methods for CVE-2026-46298

Indicators of Compromise

Soft-lockup or RCU stall messages in dmesg referencing papr_hvpipe or hvpipe_ioctl/hvpipe_release call paths.
Unresponsive CPUs on pseries LPARs coinciding with user-space activity against /dev/papr-hvpipe.
Kernel lockdep warnings reporting an inconsistent lock state between hard-IRQ and process contexts for the HVPIPE lock.

Detection Strategies

Enumerate running kernels on PowerPC pseries hosts and compare build SHAs against the fixed stable commits 342c966f81cf and 7a4f0846ee6c.
Enable CONFIG_PROVE_LOCKING (lockdep) in test environments to surface unsafe IRQ-vs-process lock usage proactively.
Monitor host availability telemetry for unexplained CPU stalls on IBM Power LPARs that consume HVPIPE.

Monitoring Recommendations

Ship kernel ring buffer and journald logs to a centralized analytics platform and alert on soft lockup, hung task, and INFO: possible recursive locking strings.
Track uptime regressions on pseries guests after kernel updates to confirm the fix is effective.
Correlate hypervisor-side interrupt rate spikes with guest-side stalls to identify exposure windows.

How to Mitigate CVE-2026-46298

Immediate Actions Required

Apply the stable kernel update containing commits 342c966f81cf and 7a4f0846ee6c to all pseries Linux systems.
Inventory PowerPC pseries LPARs running affected kernels and prioritize those exposing the HVPIPE device to non-root users.
Restrict access to the papr-hvpipe character device via filesystem permissions until patches are deployed.

Patch Information

The fix replaces non-IRQ-safe spinlock acquisitions in the ->ioctl and ->release handlers with spin_lock_irqsave/spin_unlock_irqrestore, preventing the interrupt handler from racing on the same CPU. Reference the upstream changes in the Kernel Git Commit Overview and Kernel Git Commit Details, then rebuild or install vendor kernels that incorporate them.

Workarounds

Tighten permissions on /dev/papr-hvpipe so only trusted service accounts can issue ioctl or open/close operations.
Unload or disable the papr-hvpipe driver on systems that do not require HVPIPE functionality.
Pin HVPIPE-consuming workloads to CPUs that do not service HVPIPE interrupts to reduce the same-CPU race window until patching completes.

bash

# Example: restrict access and verify patched kernel is running
sudo chmod 600 /dev/papr-hvpipe
sudo chown root:root /dev/papr-hvpipe
uname -r
dmesg | grep -i papr_hvpipe