What is the CVSS score of CVE-2026-68140?

CVE-2026-68140 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68140?

CVE-2026-68140 is a use-after-free vulnerability in the Linux kernel's IUCV subsystem affecting IBM z/VM mainframe guest systems, enabling remote kernel memory corruption with full system compromise…. A patch is available.

How to fix or mitigate CVE-2026-68140?

Within 24 hours, conduct an inventory assessment to determine if IBM z/VM mainframe guests are deployed in your infrastructure. If IBM z/VM systems are present, within 7 days apply the vendor patch available from IBM to all affected kernel versions per the vendor advisory. Within 30 days, complete patch deployment validation across all IBM z/VM guest systems and document remediation status in your vulnerability management system.

Linux Kernel CVE-2026-68140

EUVD-2026-55522 HIGH

2026-08-10 Linux

GHSA-8p4m-4f3f-9xqp

Information Disclosure Linux Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Adjacent vector reflects IUCV confinement within z/VM; PR:N because the peer requires no privilege on the victim system; full C/I/A from kernel heap corruption.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

5.8 MEDIUM

AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H

Red Hat

7.0 HIGH

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 01:59 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

8.8 (HIGH)

Patch available

Aug 10, 2026 - 14:18 EUVD

CVE Published

Aug 10, 2026 - 11:59 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: fix use-after-free of a severed iucv_path

af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.

Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.

AnalysisAI

Use-after-free in the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem exposes IBM z/VM mainframe guests to kernel memory corruption via a malicious peer. When a remote peer severs an IUCV connection, the kernel frees the iucv_path object but leaves raw, non-reference-counted pointers to it in the pending message notification queue; a subsequent recvmsg() call dereferences the freed memory, enabling heap corruption with full confidentiality, integrity, and availability impact. The vulnerability has existed since kernel 2.6.24, carries no public exploit code, and has not been added to CISA KEV, with EPSS at 0.18% reflecting its narrow IBM mainframe deployment scope.

Technical ContextAI

The vulnerable code resides in the af_iucv address-family implementation within the Linux kernel's net/iucv subsystem. IUCV (Inter-User Communication Vehicle) is an IBM mainframe communication protocol used exclusively in IBM z/VM virtual machine environments to facilitate inter-guest and guest-to-hypervisor messaging. The root cause is a classic use-after-free: iucv_sever_path() releases the iucv_path structure via iucv_path_free() when a peer severs the connection, but it does not purge entries in iucv->message_q that still hold raw (non-reference-counted) pointers to the now-freed path. When the socket's consumer later calls recvmsg(), iucv_process_message_q() iterates the queue and hands the dangling pointer to message_receive(), accessing freed kernel heap memory. Although the NVD record lists CWE as N/A, the technical description maps unambiguously to CWE-416 (Use After Free). The CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* spans all affected versions from approximately 2.6.24. This subsystem is entirely absent from non-IBM-mainframe (x86, ARM, RISC-V) kernel builds.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel version: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5, as confirmed by EUVD-2026-55522 and the upstream stable-tree commits. The fix purges queued message notifications when an IUCV path is severed, eliminating the dangling pointer entirely and also resolving a notification memory leak on socket close. For environments where immediate kernel upgrade is operationally constrained, a targeted workaround is to restrict IUCV authorization between guests in the z/VM directory configuration - specifically, removing or scoping the IUCV authorization statements that permit untrusted guest partitions to connect to the target Linux guest. This limits which peers can establish and subsequently sever connections, reducing the attacker pool to only explicitly trusted guests. The trade-off is reduced inter-guest communication capability, which must be weighed against IUCV-dependent application workloads. There is no kernel module parameter or runtime switch to disable af_iucv selectively without impacting dependent services.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-68140 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68140

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code