CVE-2026-68397

The CVE concerns the Linux kernel net/iucv subsystem (AF_IUCV sockets). In afiucv_hs_rcv(), the destination socket is looked up under iucv_sk_list.lock, then released before the socket is passed to afiucv_hs_callback_*() handlers, allowing a concurrent close to free the socket in the window befor...

CVE-2026-68141

The CVE affects the Linux kernel net/af_iucv path via afiucv_hs_callback_syn(), where a NULL child socket (nsk) after GFP_ATOMIC allocation can lead to a NULL pointer dereference when iucv_sock_kill(nsk) is invoked unconditionally in several reject paths. The fix ensures iucv_sock_kill() is calle...