kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

Ubuntu 20.04 LTS : Linux kernel (BlueField) vulnerabilities (USN-8965-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8965-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucvpath afiucv queues not-yet-received message notifications on iucv-messageq, each holding a raw pointer to the connection’s iucvpath. When the peer severs the connection, iucvseverpath...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

CVE-2026-99133

A flaw was found in the Linux kernel's IUCV Inter-User Communication Vehicle networking subsystem. A local attacker can exploit this flaw to cause a Denial of Service DoS through a kernel crash or unexpected socket disconnection. The vulnerability is triggered when processing message receive...

SUSE CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

DEBIAN-CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

AZL-111251 CVE-2026-99133 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

UBUNTU-CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

CVE-2026-99133 net/iucv: fix the recvmsg window update

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

CVE-2026-99133

The Linux kernel contains a vulnerability in the net/iucv component related to how iucv_sock_recvmsg() handles the AF_IUCV_FLAG_WIN flag. On classic z/VM sockets, the function fails to test the transport, causing iucv_send_ctrl() to size the skb through a NULL iucv->hs_dev. This allows an unpr...

CVE-2026-99133 net/iucv: fix the recvmsg window update

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

EUVD-2026-111885

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146665)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146665 advisory. In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from...

Linux Distros Unpatched Vulnerability : CVE-2026-99133

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket...

CVE-2026-99133: Linux: In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update…

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

CVE-2026-99133

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix the recvmsg window update iucvsockrecvmsg sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl sizes the skb through a NULL iucv-hsdev. SOMSGLIMIT accepts...

PT-2026-128126

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iucv sock recvmsg function where the HiperSockets-only AF IUCV FLAG WIN is sent without verifying the transport. On classic z/VM sockets, this causes iucv send ctr...