CVE-2026-46182: pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
In the Linux kernel, the following vulnerability has been resolved:
pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace
The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct paprhvpipehdr contains reserved padding bytes (reserved[3] and reserved2[40]), these could leak the uninitialized bytes to userspace after copytouser().
This patch fixes that by initializing the whole struct to 0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Initialize the entire struct papr_hvpipe_hdr to 0 (for example via memset or value-initialization) before using/copying it to userspace to prevent leaking uninitialized stack bytes.
Linux kernel (pseries/papr-hvpipe) hdr initialization = zero-initialize entire struct
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46182?
CVE-2026-46182 has a risk severity rating of 15.
How do I fix CVE-2026-46182?
To fix CVE-2026-46182, update to a patched version of the Linux kernel that addresses this vulnerability.
What components are affected by CVE-2026-46182?
CVE-2026-46182 affects the pseries/papr-hvpipe component of the Linux kernel.
What type of vulnerability is CVE-2026-46182?
CVE-2026-46182 is a memory leak vulnerability that can lead to a kernel stack memory leak to userspace.
When was CVE-2026-46182 published?
CVE-2026-46182 was published on May 28, 2026.