CVE-2024-53210

s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()

State: Published
Severity: 5.5 Medium
Published: Dec 27, 2024
Updated: May 11, 2026
Reserved: Nov 19, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct()

Passing MSG_PEEK flag to skb_recv_datagram() increments skb refcount (skb->users) and iucv_sock_recvmsg() does not decrement skb refcount at exit. This results in skb memory leak in skb_queue_purge() and WARN_ON in iucv_sock_destruct() during socket close. To fix this decrease skb refcount by one if MSG_PEEK is set in order to prevent memory leak and WARN_ON.

WARNING: CPU: 2 PID: 6292 at net/iucv/af_iucv.c:286 iucv_sock_destruct+0x144/0x1a0 [af_iucv] CPU: 2 PID: 6292 Comm: afiucv_test_msg Kdump: loaded Tainted: G W 6.10.0-rc7 #1 Hardware name: IBM 3931 A01 704 (z/VM 7.3.0) Call Trace: [<001587c682c4aa98>] iucv_sock_destruct+0x148/0x1a0 [af_iucv] [<001587c682c4a9d0>] iucv_sock_destruct+0x80/0x1a0 [af_iucv] [<001587c704117a32>] __sk_destruct+0x52/0x550 [<001587c704104a54>] __sock_release+0xa4/0x230 [<001587c704104c0c>] sock_close+0x2c/0x40 [<001587c702c5f5a8>] __fput+0x2e8/0x970 [<001587c7024148c4>] task_work_run+0x1c4/0x2c0 [<001587c7023b0716>] do_exit+0x996/0x1050 [<001587c7023b13aa>] do_group_exit+0x13a/0x360 [<001587c7023b1626>] __s390x_sys_exit_group+0x56/0x60 [<001587c7022bccca>] do_syscall+0x27a/0x380 [<001587c7049a6a0c>] __do_syscall+0x9c/0x160 [<001587c7049ce8a8>] system_call+0x70/0x98 Last Breaking-Event-Address: [<001587c682c4a9d4>] iucv_sock_destruct+0x84/0x1a0 [af_iucv]

Scores

CVSS	Score	Vector	Source
3.1	5.5 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	CISA-ADP

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime

Affected Products

Product	Versions
LinuxLinux	eac3731bd04c7131478722a3c148b78774553116 to before 934326aef7ac4652f81c69d18bf44eebaefc39c3Affected eac3731bd04c7131478722a3c148b78774553116 to before 42251c2d1ef1cb0822638bebb87ad9120c759673Affected eac3731bd04c7131478722a3c148b78774553116 to before 783c2c6e61c5a04eb8baea598753d5fa174dbe85Affected eac3731bd04c7131478722a3c148b78774553116 to before 9f603e66e1c59c1d25e60eb0636cb307d190782eAffected eac3731bd04c7131478722a3c148b78774553116 to before ebaf81317e42aa990ad20b113cfe3a7b20d4e937Affected
LinuxLinux	2.6.21Affected before 2.6.21Not affected 6.1.120 through 6.1.Not affected 6.6.64 through 6.6.Not affected 6.11.11 through 6.11.Not affected 6.12.2 through 6.12.Not affected 6.13 and laterNot affected

Product

Versions

LinuxLinux

eac3731bd04c7131478722a3c148b78774553116 to before 934326aef7ac4652f81c69d18bf44eebaefc39c3Affected
eac3731bd04c7131478722a3c148b78774553116 to before 42251c2d1ef1cb0822638bebb87ad9120c759673Affected
eac3731bd04c7131478722a3c148b78774553116 to before 783c2c6e61c5a04eb8baea598753d5fa174dbe85Affected
eac3731bd04c7131478722a3c148b78774553116 to before 9f603e66e1c59c1d25e60eb0636cb307d190782eAffected
eac3731bd04c7131478722a3c148b78774553116 to before ebaf81317e42aa990ad20b113cfe3a7b20d4e937Affected

LinuxLinux

2.6.21Affected
before 2.6.21Not affected
6.1.120 through 6.1.*Not affected
6.6.64 through 6.6.*Not affected
6.11.11 through 6.11.*Not affected
6.12.2 through 6.12.*Not affected
6.13 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.