CVE-2026-46118

In the Linux kernel, the following vulnerability has been resolved:

pseries/papr-hvpipe: Fix null ptr deref in paprhvpipedevcreatehandle()

commit 6d3789d347a7 ("papr-hvpipe: convert paprhvpipedevcreatehandle() to FDPREPARE()"), changed the create handle to FDPREPARE(), but it caused kernel null-ptr-deref because after call to retainandnullptr(srcinfo), src_info is re-used for adding it to the global list.

Getting the following kernel panic in paprhvpipedevcreatehandle() when trying to add srcinfo to the list. Kernel attempted to write user page (0) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on write at 0x00000000 Faulting instruction address: 0xc0000000001b44a0 Oops: Kernel access of bad area, sig: 11 [#1] ... Call Trace: paprhvpipedevioctl+0x1f4/0x48c (unreliable) sysioctl+0x528/0x1064 systemcallexception+0x128/0x360 systemcallvectoredcommon+0x15c/0x2ec

Now, the error handling with FD_PREPARE's file cleanup and _free(kfree) auto cleanup is getting too convoluted. This is mainly because we need to ensure only 1 user get the srcID handle. To simplify this, we allocate prepare the srcinfo in the beginning and add it to the global list under a spinlock after checking that no duplicates exist.

This simplify the error handling where if the FDADD fails, we can simply remove the srcinfo from the list and consume any pending msg in hvpipe to be cleared, after src_info became visible in the global list.