CVE-2026-68141net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path. iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference. Only call iucv_sock_kill() when a child socket was successfully allocated.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 3881ac441f642d56503818123446f7298442236b builds before 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1; from 3881ac441f642d56503818123446f7298442236b before c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953; 3881ac441f642d56503818123446f7298442236b builds before 07e21deb3664001995e0a456dd627ab7dbe127ec; 3881ac441f642d56503818123446f7298442236b builds before 8bb111f87ded6acb9837ec9b45d6f02cda94c51f; from 3881ac441f642d56503818123446f7298442236b before 46453b16f38ec7147351f7447e2aec6ea330f7b3; from 3881ac441f642d56503818123446f7298442236b before 33736ff5e7c97d3348ce812e8bd2e125d840743c; 3881ac441f642d56503818123446f7298442236b builds before 0e857185591fe79934427c9c0c1c31dc776be134; 3881ac441f642d56503818123446f7298442236b builds before 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4 | CNA record |
References
- https://git.kernel.org/stable/c/6a1eb5b46c19073f8153b7e2c19b408cf353aaf1
- https://git.kernel.org/stable/c/c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953
- https://git.kernel.org/stable/c/07e21deb3664001995e0a456dd627ab7dbe127ec
- https://git.kernel.org/stable/c/8bb111f87ded6acb9837ec9b45d6f02cda94c51f
- https://git.kernel.org/stable/c/46453b16f38ec7147351f7447e2aec6ea330f7b3
- https://git.kernel.org/stable/c/33736ff5e7c97d3348ce812e8bd2e125d840743c
- https://git.kernel.org/stable/c/0e857185591fe79934427c9c0c1c31dc776be134
- https://git.kernel.org/stable/c/47a5116e56a6b6fe1e909f244e39cd0fc26ceee4
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.