UBUNTU-CVE-2026-46118
In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"), changed the create handle to FD_PREPARE(), but it caused kernel null-ptr-deref because after call to retain_and_null_ptr(src_info), src_info is re-used for adding it to the global list. Getting the following kernel panic in papr_hvpipe_dev_create_handle() when trying to add src_info to the list. Kernel attempted to write user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x00000000 Faulting instruction address: 0xc0000000001b44a0 Oops: Kernel access of bad area, sig: 11 [#1] ... Call Trace: papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable) sys_ioctl+0x528/0x1064 system_call_exception+0x128/0x360 system_call_vectored_common+0x15c/0x2ec Now, the error handling with FD_PREPARE's file cleanup and __free(kfree) auto cleanup is getting too convoluted. This is mainly because we need to ensure only 1 user get the srcID handle. To simplify this, we allocate prepare the src_info in the beginning and add it to the global list under a spinlock after checking that no duplicates exist. This simplify the error handling where if the FD_ADD fails, we can simply remove the src_info from the list and consume any pending msg in hvpipe to be cleared, after src_info became visible in the global list.
02 / AFFECTED SOFTWARE
Affected packages
10 explicit affected versions
23 explicit affected versions
1 explicit affected versions
21 explicit affected versions
16 explicit affected versions
10 explicit affected versions
7 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
13 explicit affected versions
12 explicit affected versions
5 explicit affected versions
51 explicit affected versions
7 explicit affected versions
12 explicit affected versions
12 explicit affected versions
10 explicit affected versions
37 explicit affected versions
13 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
26 explicit affected versions
13 explicit affected versions
29 explicit affected versions
8 explicit affected versions
8 explicit affected versions
4 explicit affected versions
1 explicit affected versions
9 explicit affected versions
11 explicit affected versions
7 explicit affected versions
7 explicit affected versions
13 explicit affected versions
43 explicit affected versions
10 explicit affected versions
8 explicit affected versions
14 explicit affected versions
4 explicit affected versions
11 explicit affected versions
4 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
10 explicit affected versions
3 explicit affected versions
7 explicit affected versions
13 explicit affected versions
26 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
24 explicit affected versions
2 explicit affected versions
26 explicit affected versions
7 explicit affected versions
13 explicit affected versions
35 explicit affected versions
1 explicit affected versions
18 explicit affected versions
1 explicit affected versions
13 explicit affected versions
4 explicit affected versions
14 explicit affected versions
1 explicit affected versions
7 explicit affected versions
12 explicit affected versions
9 explicit affected versions
9 explicit affected versions
16 explicit affected versions
6 explicit affected versions
33 explicit affected versions
23 explicit affected versions
10 explicit affected versions
11 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
17 explicit affected versions
5 explicit affected versions
26 explicit affected versions
11 explicit affected versions
13 explicit affected versions
16 explicit affected versions
10 explicit affected versions
18 explicit affected versions
12 explicit affected versions
27 explicit affected versions
3 explicit affected versions
3 explicit affected versions
5 explicit affected versions
8 explicit affected versions
6 explicit affected versions
10 explicit affected versions
7 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
45 explicit affected versions
37 explicit affected versions
14 explicit affected versions
38 explicit affected versions
78 explicit affected versions
11 explicit affected versions
1 explicit affected versions
6 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix null ptr deref in papr_hvpipe_dev_create_handle() commit 6d3789d347a7 ("papr-hvpipe: convert papr_hvpipe_dev_create_handle() to FD_PREPARE()"), changed the create handle to FD_PREPARE(), but it caused kernel null-ptr-deref because after call to retain_and_null_ptr(src_info), src_info is re-used for adding it to the global list. Getting the following kernel panic in papr_hvpipe_dev_create_handle() when trying to add src_info to the list. Kernel attempted to write user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x00000000 Faulting instruction address: 0xc0000000001b44a0 Oops: Kernel access of bad area, sig: 11 [#1] ... Call Trace: papr_hvpipe_dev_ioctl+0x1f4/0x48c (unreliable) sys_ioctl+0x528/0x1064 system_call_exception+0x128/0x360 system_call_vectored_common+0x15c/0x2ec Now, the error handling with FD_PREPARE's file cleanup and __free(kfree) auto cleanup is getting too convoluted. This is mainly because we need to ensure only 1 user get the srcID handle. To simplify this, we allocate prepare the src_info in the beginning and add it to the global list under a spinlock after checking that no duplicates exist. This simplify the error handling where if the FD_ADD fails, we can simply remove the src_info from the list and consume any pending msg in hvpipe to be cleared, after src_info became visible in the global list.
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/1b9f7aafa44f5ce852c00509104d10fd9eb0f402
- https://git.kernel.org/stable/c/1b9f7aafa44f5ce852c00509104d10fd9eb0f402
- https://git.kernel.org/stable/c/735439394dde8462f9b50566727fbe333beaadaf
- https://git.kernel.org/stable/c/cf51bec1560f8bf115d1476f60335f9d90e110b0
- https://ubuntu.com/security/CVE-2026-46118
- https://ubuntu.com/security/notices/USN-8566-1
- https://ubuntu.com/security/notices/USN-8568-1
- https://ubuntu.com/security/notices/USN-8569-1
- https://ubuntu.com/security/notices/USN-8593-1
- https://ubuntu.com/security/notices/USN-8603-1
- https://ubuntu.com/security/notices/USN-8618-1
- https://www.cve.org/CVERecord?id=CVE-2026-46118