CVE-2026-64004

net/iucv: fix locking in .getsockopt

State: Published
Severity: 7.8 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: fix locking in .getsockopt

Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed.

Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	51363b8751a673a00ad48eea895266396d53fa52 to before 884eb247b74d86db97e3a37f0d6fc8e1e83590ddAffected 51363b8751a673a00ad48eea895266396d53fa52 to before 45bb8de8c95d8899f4b8f61bd9bceb8132af73cbAffected 51363b8751a673a00ad48eea895266396d53fa52 to before 1fc30bd4e55e2dd622d2d366cecd732c1841bbeeAffected 51363b8751a673a00ad48eea895266396d53fa52 to before cd691beafea0dd779e69e81ccc26b0ab50efcb5eAffected 51363b8751a673a00ad48eea895266396d53fa52 to before 6e792b8dd3002bbc4136745928a9605df1a72b8aAffected 51363b8751a673a00ad48eea895266396d53fa52 to before 9817369243380e287ebe5525411557eaa3aa2a79Affected 51363b8751a673a00ad48eea895266396d53fa52 to before 69554adc7a6fa04ede3ad7512321d83748e3c920Affected 51363b8751a673a00ad48eea895266396d53fa52 to before 3589d20a666caf30ad100c960a2de7de390fce88Affected
LinuxLinux	3.4Affected before 3.4Not affected 5.10.259 through 5.10.Not affected 5.15.210 through 5.15.Not affected 6.1.176 through 6.1.Not affected 6.6.143 through 6.6.Not affected 6.12.93 through 6.12.Not affected 6.18.35 through 6.18.Not affected 7.0.12 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

51363b8751a673a00ad48eea895266396d53fa52 to before 884eb247b74d86db97e3a37f0d6fc8e1e83590ddAffected
51363b8751a673a00ad48eea895266396d53fa52 to before 45bb8de8c95d8899f4b8f61bd9bceb8132af73cbAffected
51363b8751a673a00ad48eea895266396d53fa52 to before 1fc30bd4e55e2dd622d2d366cecd732c1841bbeeAffected
51363b8751a673a00ad48eea895266396d53fa52 to before cd691beafea0dd779e69e81ccc26b0ab50efcb5eAffected
51363b8751a673a00ad48eea895266396d53fa52 to before 6e792b8dd3002bbc4136745928a9605df1a72b8aAffected
51363b8751a673a00ad48eea895266396d53fa52 to before 9817369243380e287ebe5525411557eaa3aa2a79Affected
51363b8751a673a00ad48eea895266396d53fa52 to before 69554adc7a6fa04ede3ad7512321d83748e3c920Affected
51363b8751a673a00ad48eea895266396d53fa52 to before 3589d20a666caf30ad100c960a2de7de390fce88Affected

LinuxLinux

3.4Affected
before 3.4Not affected
5.10.259 through 5.10.*Not affected
5.15.210 through 5.15.*Not affected
6.1.176 through 6.1.*Not affected
6.6.143 through 6.6.*Not affected
6.12.93 through 6.12.*Not affected
6.18.35 through 6.18.*Not affected
7.0.12 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.