CVE-2026-46118
Null Pointer Dereference in Linux Kernel pseries/papr-hvpipe
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a null pointer dereference in the Linux kernel's pseries/papr-hvpipe component, specifically in the function papr_hvpipe_dev_create_handle().
A recent code change converted papr_hvpipe_dev_create_handle() to use FD_PREPARE(), but this caused a kernel null pointer dereference because after calling retain_and_null_ptr(src_info), the src_info pointer was reused incorrectly when adding it to a global list.
This leads to a kernel panic when the kernel tries to add src_info to the list, resulting in a crash due to a null pointer dereference.
How can this vulnerability impact me? :
This vulnerability can cause a kernel panic, which means the Linux system could crash unexpectedly.
Such crashes can lead to denial of service, making the system unavailable until it is rebooted.
Additionally, the kernel log shows an attempted write to a user page at address 0, which may indicate an exploit attempt.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a kernel panic caused by a NULL pointer dereference in the papr_hvpipe_dev_create_handle() function. Detection involves monitoring system logs for kernel panic messages related to papr_hvpipe and NULL pointer dereferences.
- Check kernel logs for messages like 'BUG: Kernel NULL pointer dereference on write at 0x00000000' or 'Kernel attempted to write user page (0) - exploit attempt? (uid: 0)'.
- Use the command: dmesg | grep -i 'papr_hvpipe' to filter relevant kernel panic traces.
- Monitor system logs (e.g., /var/log/kern.log or /var/log/messages) for similar error patterns.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the Linux kernel to a version that includes the fix for this vulnerability, which addresses the null pointer dereference in papr_hvpipe_dev_create_handle() by properly handling FD_PREPARE and error cleanup.
Until the update can be applied, avoid using the papr_hvpipe interface or related functionality that triggers the vulnerable code path to prevent kernel panics.