CVE-2026-68397
Description
In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()). Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.
How to fix
- Linux Linux5739be5c19495d709d902a2912c9102ce78740d5, bc6c6e546ffff8865daaeb622ef348c2d481e80f, e3e0679fc950191aff8f27fa78abcfc2462cff4a, 4dc0e63abf8bc7ba8892e617c1fb8b204361e022, 1801cb20a5025a787d6853e19c38db138344b4b4, c75a950e77356e526672cba4584080c6c8b793b6, 5595ea59cdf29182cf6a270cacc1426c57b603de, 4fa349156043dc119721d067329714179f501749 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 3881ac441f642d56503818123446f7298442236b ≤ v < 5739be5c19495d709d902a2912c9102ce78740d5, 3881ac441f642d56503818123446f7298442236b ≤ v < bc6c6e546ffff8865daaeb622ef348c2d481e80f, 3881ac441f642d56503818123446f7298442236b ≤ v < e3e0679fc950191aff8f27fa78abcfc2462cff4a, 3881ac441f642d56503818123446f7298442236b ≤ v < 4dc0e63abf8bc7ba8892e617c1fb8b204361e022, 3881ac441f642d56503818123446f7298442236b ≤ v < 1801cb20a5025a787d6853e19c38db138344b4b4, 3881ac441f642d56503818123446f7298442236b ≤ v < c75a950e77356e526672cba4584080c6c8b793b6, 3881ac441f642d56503818123446f7298442236b ≤ v < 5595ea59cdf29182cf6a270cacc1426c57b603de, 3881ac441f642d56503818123446f7298442236b ≤ v < 4fa349156043dc119721d067329714179f501749, 3.2 | 5739be5c19495d709d902a2912c9102ce78740d5, bc6c6e546ffff8865daaeb622ef348c2d481e80f, e3e0679fc950191aff8f27fa78abcfc2462cff4a, 4dc0e63abf8bc7ba8892e617c1fb8b204361e022, 1801cb20a5025a787d6853e19c38db138344b4b4, c75a950e77356e526672cba4584080c6c8b793b6, 5595ea59cdf29182cf6a270cacc1426c57b603de, 4fa349156043dc119721d067329714179f501749 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.