SUSE CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: net/iucv: Avoid explicit allocation of the cpumask variable on the stack. For the CONFIGCPUMASKOFFSTACK=y kernel, explicit allocation of the cpumask variable on the stack is not recommended, as it may cause a potential stack...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: net/iucv: Fixed the size of interrupt data iucvirqdata needs to be 4 bytes larger. These bytes are not used by the iucv module, but are written by the z/VM hypervisor in case a CPU is deconfigured. Reported as: BUG...

DEBIAN-CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003

CVE-2026-81003 affects the Linux kernel net/iucv subsystem (IBM s390 IUCV/HiperSockets). The function afiucv_hs_rcv() matched incoming frames to sockets using only four 8-byte name fields in the transport header, without verifying the ingress net_device . This allowed frames from any network devi...

CVE-2026-81003 net/iucv: filter frames in afiucv_hs_rcv() by ingress device

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

The vulnerability of the iucv_sock_getsockopt() function in the net/iucv/af_iucv.c module, which is part of the Linux kernel’s networking functions, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the iucvsockgetsockopt function in the net/iucv/afiucv.c module, which implements kernel networking functions in the Linux operating system, is related to the pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

SUSE CVE-2026-68397

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

CVE-2026-68140

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

CVE-2026-68397

A flaw was found in the Linux kernel's net/iucv module. The afiucvhsrcv function fails to properly manage socket references. This allows a local attacker to trigger a use-after-free vulnerability by concurrently closing a socket while it is being processed. Successful exploitation can lead to a...

net/iucv: fix use-after-free of a severed iucv_path

...

net/iucv: take a reference on the socket found in afiucv_hs_rcv()

...

CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection's iucvpath. When the peer severs the connection, iucvseverpath...

EUVD-2026-55583

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

CVE-2026-68397

The CVE-2026-68397 issue affects the Linux kernel net/iucv code: afiucv_hs_rcv() may pass a destination socket to handlers without holding a reference, allowing a concurrent close to free the socket before the handler dereferences it (e.g., sk->sk_data_ready()) because AF_IUCV sockets aren’t R...

CVE-2026-68397 net/iucv: take a reference on the socket found in afiucv_hs_rcv()

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...