CVE-2026-46118 is a vulnerability in the Linux kernel's papr-hvpipe device driver where a null pointer dereference occurs in the function papr_hvpipe_dev_create_handle(). This was introduced after changing the create handle function to use FD_PREPARE(), which caused src_info to be reused improperly after being nulled, leading to a kernel panic when attempting to add it to a global list. The vulnerability results in a denial of service condition due to kernel crash. The issue has been resolved in Linux kernel versions 7.0.0-28.28 and later. The fix involves proper error handling with FD_PREPARE's file cleanup and freeing resources correctly.

The vulnerability can cause a kernel panic and denial of service by triggering a null pointer dereference in the papr-hvpipe device driver. There is no indication of confidentiality or integrity impact. The CVSS score is 5.5 (medium severity), reflecting local attack vector with low complexity and no user interaction required, but only availability impact.

A patch is available and should be applied by updating the Linux kernel to version 7.0.0-28.28 or later (and corresponding patched builds). After applying the update, a system reboot is required. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions for updating kernel packages to the fixed versions listed in the Ubuntu security advisories USN-8566-1 and USN-8568-1.