PT-2026-90133

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the afiucv hs rcv function where sockets are selected from the iucv sk list based solely on four 8-byte name fields in the transport header, without verifying the net...

CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

CVE-2026-68397

The CVE-2026-68397 issue affects the Linux kernel net/iucv code: afiucv_hs_rcv() may pass a destination socket to handlers without holding a reference, allowing a concurrent close to free the socket before the handler dereferences it (e.g., sk->sk_data_ready()) because AF_IUCV sockets aren’t R...

CVE-2026-68397 net/iucv: take a reference on the socket found in afiucv_hs_rcv()

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

CVE-2026-68141 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

In the Linux kernel, the following vulnerability has been resolved: net/afiucv: fix NULL deref in afiucvhscallbacksyn afiucvhscallbacksyn allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the...

CVE-2026-68141

The CVE-2026-68141 issue affects the Linux kernel’s af_iucv path. afiucv_hs_callback_syn() may allocate a child socket; if allocation fails, nsk becomes NULL and the code may call iucv_sock_kill(nsk), which dereferences a NULL pointer. The result is a NULL pointer dereference causing a system cra...

PT-2026-69541

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference exists in the afiucv hs callback syn function. This occurs when the function attempts to allocate a child socket using GFP ATOMIC and the allocation fails,...