CVE-2026-68397net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()). Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.
- CVSS
- 8.8 HIGH (v3.1, CNA)CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 3881ac441f642d56503818123446f7298442236b before 5739be5c19495d709d902a2912c9102ce78740d5; from 3881ac441f642d56503818123446f7298442236b before bc6c6e546ffff8865daaeb622ef348c2d481e80f; from 3881ac441f642d56503818123446f7298442236b before e3e0679fc950191aff8f27fa78abcfc2462cff4a; 3881ac441f642d56503818123446f7298442236b builds before 4dc0e63abf8bc7ba8892e617c1fb8b204361e022; 3881ac441f642d56503818123446f7298442236b builds before 1801cb20a5025a787d6853e19c38db138344b4b4; from 3881ac441f642d56503818123446f7298442236b before c75a950e77356e526672cba4584080c6c8b793b6; from 3881ac441f642d56503818123446f7298442236b before 5595ea59cdf29182cf6a270cacc1426c57b603de; 3881ac441f642d56503818123446f7298442236b builds before 4fa349156043dc119721d067329714179f501749 | CNA record |
References
- https://git.kernel.org/stable/c/5739be5c19495d709d902a2912c9102ce78740d5
- https://git.kernel.org/stable/c/bc6c6e546ffff8865daaeb622ef348c2d481e80f
- https://git.kernel.org/stable/c/e3e0679fc950191aff8f27fa78abcfc2462cff4a
- https://git.kernel.org/stable/c/4dc0e63abf8bc7ba8892e617c1fb8b204361e022
- https://git.kernel.org/stable/c/1801cb20a5025a787d6853e19c38db138344b4b4
- https://git.kernel.org/stable/c/c75a950e77356e526672cba4584080c6c8b793b6
- https://git.kernel.org/stable/c/5595ea59cdf29182cf6a270cacc1426c57b603de
- https://git.kernel.org/stable/c/4fa349156043dc119721d067329714179f501749
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.