Skip to main content

Linux Kernel EUVDEUVD-2026-55523

| CVE-2026-68141 HIGH
2026-08-10 Linux GHSA-p635-m8r7-fc75
Denial Of Service Linux
7.5
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.9 MEDIUM

Network-reachable via HiperSockets but reliable trigger requires concurrent GFP_ATOMIC failure under memory pressure, warranting AC:H; no auth, no confidentiality or integrity impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 01:41 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.5 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 11:59 cve.org
HIGH 7.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL.

The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path.

iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference.

Only call iucv_sock_kill() when a child socket was successfully allocated.

AnalysisAI

NULL pointer dereference in the Linux kernel's af_iucv network subsystem allows a remote attacker to crash a vulnerable kernel via a crafted SYN packet under low-memory conditions, resulting in a denial of service. The flaw resides in afiucv_hs_callback_syn(), where an unconditional call to iucv_sock_kill(nsk) is made even when nsk is NULL following a failed GFP_ATOMIC socket allocation, causing an immediate kernel panic. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), reflecting low probability of widespread exploitation; however, the mainframe-specific HiperSockets network path reduces the realistic attacker pool significantly.

Technical ContextAI

The af_iucv socket family (AF_IUCV) implements IBM's Inter-User Communication Vehicle (IUCV) protocol for Linux on IBM Z (zSeries, s390x) mainframe systems. The HiperSockets variant (HS) routes IUCV traffic over internal ethernet frames between partitions. The vulnerable function afiucv_hs_callback_syn() handles incoming TCP SYN-equivalent connection requests on this interface. It uses GFP_ATOMIC (non-blocking) memory allocation to create a child socket; GFP_ATOMIC can return NULL under memory pressure without sleeping. The root cause (no CWE assigned by NVD, but best described as CWE-476: NULL Pointer Dereference) is that the error path unconditionally calls iucv_sock_kill(nsk) regardless of whether allocation succeeded - iucv_sock_kill() immediately dereferences the socket via sock_flag(), crashing the kernel when given a NULL pointer. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel: 6.6.148 or later for the 6.6 stable branch, 6.12.101 or later for the 6.12 stable branch, 6.18.42 or later for the 6.18 branch, 7.1.6 or later for the 7.1 branch, or 7.2-rc5 or later in mainline. The fix commits are available at https://git.kernel.org/stable/c/8bb111f87ded6acb9837ec9b45d6f02cda94c51f and related stable-tree commits. For IBM Z operators unable to patch immediately, a viable compensating control is to unload or blacklist the af_iucv kernel module (rmmod af_iucv; echo 'blacklist af_iucv' >> /etc/modprobe.d/blacklist.conf) - note this will terminate all active IUCV socket communications and disable the HiperSockets IUCV transport, which may impact applications relying on inter-partition communication. Alternatively, restricting network access to the HiperSockets interface at the LPAR or OSA level reduces the external attacker surface without fully disabling af_iucv functionality for trusted internal consumers.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55523 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy