PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46182 Linux CVE debrief

A kernel stack memory leak vulnerability in the Linux kernel's pseries/papr-hvpipe subsystem has been resolved. The issue stemmed from incomplete initialization of a stack-allocated `struct papr_hvpipe_hdr` structure, where reserved padding bytes (`reserved[3]` and `reserved2[40]`) could leak uninitialized kernel stack memory to userspace via `copy_to_user()`. The fix ensures complete zero-initialization of the structure before use. This vulnerability affects IBM Power Systems (pseries) running Linux with the papr-hvpipe driver enabled. The issue was disclosed on 2026-05-28 and patches are available for affected stable kernel branches.

Vendor
Linux
Product
Unknown
CVSS
MEDIUM 5.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-11
Advisory published
2026-05-28
Advisory updated
2026-06-11

Who should care

Organizations running IBM Power Systems (pseries) with Linux kernels that include the papr-hvpipe driver, particularly multi-tenant environments where kernel memory leaks could expose sensitive information across security boundaries.

Technical summary

The papr_hvpipe_hdr structure in the Linux kernel's pseries/papr-hvpipe driver was allocated on the stack with only partial explicit initialization. Reserved padding fields within the structure could contain uninitialized stack data that would be copied to userspace, resulting in information disclosure. The vulnerability is resolved by zero-initializing the entire structure using memset or equivalent initialization.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from your Linux distribution that include the fix for CVE-2026-46182
  • Verify running kernel version is patched if using IBM Power Systems (pseries) with papr-hvpipe
  • Review systems for unauthorized access that may have exploited information disclosure vulnerabilities prior to patching
  • Monitor for distribution-specific security advisories for kernel package updates

Evidence notes

The vulnerability description confirms the issue is in the pseries/papr-hvpipe driver within the Linux kernel. The fix involves initializing the entire `struct papr_hvpipe_hdr` to zero rather than only explicitly setting `hdr.version` and `hdr.flags`. Multiple stable kernel branch commits are referenced, indicating backports to supported releases.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46182 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46182

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46182 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46182

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/0479b6e9f999cc1cbad7d9f09f574fc387e605d5

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cefeed44296261173a806bef988b26bc565da4be

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f88f8e4485b437e0a2f96a7ff1f88aa22d925659

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.