{"id":"CVE-2026-46182","title":"pseries/papr-hvpipe: Prevent kernel stack memory leak to userspace","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\npseries/papr-hvpipe: Prevent kernel stack memory leak to userspace\n\nThe hdr variable is allocated on the stack and only hdr.version and\nhdr.flags are initialized explic…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 < 0479b6e9f999cc1cbad7d9f09f574fc387e605d5","Linux >= cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 < f88f8e4485b437e0a2f96a7ff1f88aa22d925659","Linux >= cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 < cefeed44296261173a806bef988b26bc565da4be","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:11:21.834383Z"},"published":"2026-05-28","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:13:43.452Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46182","references":[{"url":"https://git.kernel.org/stable/c/0479b6e9f999cc1cbad7d9f09f574fc387e605d5"},{"url":"https://git.kernel.org/stable/c/f88f8e4485b437e0a2f96a7ff1f88aa22d925659"},{"url":"https://git.kernel.org/stable/c/cefeed44296261173a806bef988b26bc565da4be"}],"tags":["cve.org"],"epss":0.00126,"epssPercentile":0.02322,"ingestedAt":"2026-11-06T16:57:43.327Z","slug":"CVE-2026-46182","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\npseries/papr-hvpipe: Prevent kernel stack memory leak to userspace\n\nThe hdr variable is allocated on the stack and only hdr.version and\nhdr.flags are initialized explicitly. Because the struct papr_hvpipe_hdr\ncontains reserved padding bytes (reserved[3] and reserved2[40]), these\ncould leak the uninitialized bytes to userspace after copy_to_user().\n\nThis patch fixes that by initializing the whole struct to 0.\n\n## Affected\n\n- `Linux >= cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 < 0479b6e9f999cc1cbad7d9f09f574fc387e605d5`\n- `Linux >= cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 < f88f8e4485b437e0a2f96a7ff1f88aa22d925659`\n- `Linux >= cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 < cefeed44296261173a806bef988b26bc565da4be`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}