CVE-2026-53306

tty: hvc_iucv: fix off-by-one in number of supported devices

State: Published
Severity: Not scored
Published: Jun 26, 2026
Updated: Jun 26, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tty: hvc_iucv: fix off-by-one in number of supported devices

MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES];

Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.)

hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES)

If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 3d3b89e6ab93bdd0efd45828bda6b0e61cc46dffAffected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 484357dff256c816d9466bda35eb765685e4dc86Affected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 11207e42a332eb8bbcb9fe74df9edd2a807c5607Affected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4Affected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before a76511bc654819425d3b15e77b523d7f9d81f064Affected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 3104a3f40feb107f77d7116ad9bf6c210ab7babfAffected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before f1dc8e72de9aabe5d96767a4e97219ac26b79fe5Affected 44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before f2a880e802ad12d1e38039d1334fb1475d0f5241Affected
LinuxLinux	2.6.29Affected before 2.6.29Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 3d3b89e6ab93bdd0efd45828bda6b0e61cc46dffAffected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 484357dff256c816d9466bda35eb765685e4dc86Affected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 11207e42a332eb8bbcb9fe74df9edd2a807c5607Affected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4Affected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before a76511bc654819425d3b15e77b523d7f9d81f064Affected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before 3104a3f40feb107f77d7116ad9bf6c210ab7babfAffected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before f1dc8e72de9aabe5d96767a4e97219ac26b79fe5Affected
44a01d5ba8a4d543694461cd3e178cfa6b3f221b to before f2a880e802ad12d1e38039d1334fb1475d0f5241Affected

LinuxLinux

2.6.29Affected
before 2.6.29Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.