CVE-2026-46118

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle()

commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"),

changed the create handle to FD_PREPARE(), but it caused kernel

null-ptr-deref because after call to retain_and_null_ptr(src_info),

src_info is re-used for adding it to the global list.

Getting the following kernel panic in papr_hvpipe_dev_create_handle()

when trying to add src_info to the list.

Kernel attempted to write user page (0) - exploit attempt? (uid: 0)

BUG: Kernel NULL pointer dereference on write at 0x00000000

Faulting instruction address: 0xc0000000001b44a0

Oops: Kernel access of bad area, sig: 11 [#1]

...

Call Trace:

papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable)

sys_ioctl+0x528/0x1064

system_call_exception+0x128/0x360

system_call_vectored_common+0x15c/0x2ec

Now, the error handling with FD_PREPARE's file cleanup and __free(kfr

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References