The fault occurs in the Linux kernel’s papr-hvpipe driver when the papr_hvpipe_dev_create_handle() function reuses a source information structure after a retain_and_null_ptr call. This results in a NULL pointer dereference that crashes the kernel, as the code attempts to write user data to address zero. The crash causes a kernel panic, leading to a denial of service. The weakness is a null‑pointer dereference, formally identified as CWE‑476.

This vulnerability affects Linux kernel builds that include the papr-hvpipe module. The CPE entries indicate that all kernels with the papr-hvpipe driver are affected, including the release series Linux kernel 6.18.32 and the 7.1 release candidates 7.1‑rc1 and 7.1‑rc2. Until the patch is applied, any kernel containing the unpatched papr-hvpipe code should be considered vulnerable.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA KEV. It causes a kernel panic, resulting in denial of service. Based on the description, it is inferred that an attacker would need to trigger the fault by invoking the problematic ioctl, likely requiring privileged access to the device. The risk is moderate given the CVSS, EPSS, and lack of known exploitation.