CVE-2026-68141

net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

State: Published
Severity: 7.5 High
Published: Aug 10, 2026
Updated: Oct 19, 2026
Reserved: Jul 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL.

The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path.

iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference.

Only call iucv_sock_kill() when a child socket was successfully allocated.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	3881ac441f642d56503818123446f7298442236b to before 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1Affected 3881ac441f642d56503818123446f7298442236b to before c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953Affected 3881ac441f642d56503818123446f7298442236b to before 07e21deb3664001995e0a456dd627ab7dbe127ecAffected 3881ac441f642d56503818123446f7298442236b to before 8bb111f87ded6acb9837ec9b45d6f02cda94c51fAffected 3881ac441f642d56503818123446f7298442236b to before 46453b16f38ec7147351f7447e2aec6ea330f7b3Affected 3881ac441f642d56503818123446f7298442236b to before 33736ff5e7c97d3348ce812e8bd2e125d840743cAffected 3881ac441f642d56503818123446f7298442236b to before 0e857185591fe79934427c9c0c1c31dc776be134Affected 3881ac441f642d56503818123446f7298442236b to before 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4Affected
LinuxLinux	3.2Affected before 3.2Not affected 5.10.265 through 5.10.Not affected 5.15.216 through 5.15.Not affected 6.1.183 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.42 through 6.18.Not affected 7.1.6 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

3881ac441f642d56503818123446f7298442236b to before 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1Affected
3881ac441f642d56503818123446f7298442236b to before c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953Affected
3881ac441f642d56503818123446f7298442236b to before 07e21deb3664001995e0a456dd627ab7dbe127ecAffected
3881ac441f642d56503818123446f7298442236b to before 8bb111f87ded6acb9837ec9b45d6f02cda94c51fAffected
3881ac441f642d56503818123446f7298442236b to before 46453b16f38ec7147351f7447e2aec6ea330f7b3Affected
3881ac441f642d56503818123446f7298442236b to before 33736ff5e7c97d3348ce812e8bd2e125d840743cAffected
3881ac441f642d56503818123446f7298442236b to before 0e857185591fe79934427c9c0c1c31dc776be134Affected
3881ac441f642d56503818123446f7298442236b to before 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4Affected

LinuxLinux

3.2Affected
before 3.2Not affected
5.10.265 through 5.10.*Not affected
5.15.216 through 5.15.*Not affected
6.1.183 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.42 through 6.18.*Not affected
7.1.6 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.