CVE-2026-46182 Details
Description
In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace The hdr variable is allocated on the stack and only hdr.version and hdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr contains reserved padding bytes (reserved[3] and reserved2[40]), these could leak the uninitialized bytes to userspace after copy_to_user(). This patch fixes that by initializing the whole struct to 0.
A vulnerability in the Linux kernel's pseries/papr-hvpipe component could lead to a memory leak from the kernel stack to userspace. The issue arises because the header variable in this component is allocated on the stack, and only certain fields are explicitly initialized. The structure contains reserved padding bytes that, if uninitialized, could leak data to userspace after a copy operation. This vulnerability has been addressed by ensuring the entire structure is properly initialized before being sent to userspace.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been patched. The specific commit addressing this issue is available in the Linux kernel stable tree.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0479b6e9f999cc1cbad7d9f09f574fc387e605d5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/cefeed44296261173a806bef988b26bc565da4be | kernel.org | Patch |
| https://git.kernel.org/stable/c/f88f8e4485b437e0a2f96a7ff1f88aa22d925659 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.18, < 6.18.30 >= 6.19, < 7.0.7 7.1 rc1 7.1 rc2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 11, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | New CVE Received | kernel.org |