PT-2026-44241 · Linux · Linux
Published
2026-05-28
·
Updated
2026-05-28
·
CVE-2026-46118
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
pseries/papr-hvpipe: Fix null ptr deref in papr hvpipe dev create handle()
commit 6d3789d347a7 ("papr-hvpipe: convert papr hvpipe dev create handle() to FD PREPARE()"),
changed the create handle to FD PREPARE(), but it caused kernel
null-ptr-deref because after call to retain and null ptr(src info),
src info is re-used for adding it to the global list.
Getting the following kernel panic in papr hvpipe dev create handle()
when trying to add src info to the list.
Kernel attempted to write user page (0) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on write at 0x00000000
Faulting instruction address: 0xc0000000001b44a0
Oops: Kernel access of bad area, sig: 11 [#1]
...
Call Trace:
papr hvpipe dev ioctl+0x1f4/0x48c (unreliable)
sys ioctl+0x528/0x1064
system call exception+0x128/0x360
system call vectored common+0x15c/0x2ec
Now, the error handling with FD PREPARE's file cleanup and free(kfree) auto
cleanup is getting too convoluted. This is mainly because we need to
ensure only 1 user get the srcID handle. To simplify this, we allocate
prepare the src info in the beginning and add it to the global list
under a spinlock after checking that no duplicates exist.
This simplify the error handling where if the FD ADD fails, we can
simply remove the src info from the list and consume any pending msg in
hvpipe to be cleared, after src info became visible in the global list.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux