The fault occurs in the Linux kernel’s papr-hvpipe driver when the papr_hvpipe_dev_create_handle() function reuses a source information structure after a retain_and_null_ptr call. This results in a NULL pointer dereference that crashes the kernel, as the code attempts to write user data to address zero. The crash causes a kernel panic, leading to a denial of service. The weakness is a null-pointer dereference, formally identified as CWE‑476.

This vulnerability affects Linux kernel builds that include the papr-hvpipe module. The description does not list specific kernel releases; any kernel containing the unpatched papr-hvpipe code is at risk. No version range is provided, so all kernels with that module should be considered vulnerable until the patch is applied.

The CVSS score is not supplied, and EPSS is not available, so numerical risk quantification is missing. The flaw can cause a kernel panic, which results in a denial of service. An attacker would need to trigger the fault by invoking the problematic ioctl that calls papr_hvpipe_dev_create_handle(). The likely attack vector is a privileged ioctl invocation, inferred from the need to access the papr-hvpipe device, but the description does not specify the required privileges. The issue is not listed in CISA KEV, and there is no evidence of exploitation in the wild.