CVE-2026-68397
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability was found in the Linux kernel's net/iucv subsystem where a socket found in afiucv_hs_rcv() is not properly referenced. After releasing the lock, the socket can be closed and freed before the event handler uses it, leading to use-after-free.
Risk Assessment
This could lead to system crashes or potentially arbitrary code execution in kernel context.
Recommendation
Install a Linux kernel update containing the fix that adds sock_hold() before passing the socket to the handler and sock_put() after it runs.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()). Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.