Skip to main content

Linux Kernel EUVDEUVD-2026-55583

| CVE-2026-68397 HIGH
2026-08-10 Linux GHSA-7m4h-5x7q-hf25
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.5 HIGH

Race condition exploitation requires precise timing between lock release and socket close, elevating AC to H over NVD's AC:L; AV:A and PR:N retained from vector as HiperSockets adjacency and no attacker authentication are confirmed.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:47 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
8.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 12:04 cve.org
HIGH 8.8
CVE Published
Aug 10, 2026 - 12:04 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: take a reference on the socket found in afiucv_hs_rcv()

afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).

Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.

AnalysisAI

Use-after-free race condition in the Linux kernel AF_IUCV HiperSockets receive path allows a network-adjacent unauthenticated attacker to dereference freed kernel memory, potentially achieving kernel code execution and full system compromise. The flaw exclusively affects IBM z/Architecture (mainframe) systems running Linux under z/VM with the AF_IUCV subsystem active, making the exploitable population extremely narrow. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with the niche deployment context; patched stable kernel releases are available across multiple branches.

Technical ContextAI

AF_IUCV (Inter-User Communication Vehicle) is an IBM-proprietary communication protocol enabling socket-based IPC between Linux z/VM guest virtual machines via HiperSockets or guest LAN on IBM Z (mainframe) hardware. The vulnerable function, afiucv_hs_rcv() in net/iucv/af_iucv.c, performs a socket lookup under iucv_sk_list.lock (a read-write spinlock), releases the lock, and then invokes callback handlers such as afiucv_hs_callback_syn() on the socket pointer without first incrementing the reference count via sock_hold(). AF_IUCV sockets are not RCU-protected and are freed synchronously through the iucv_sock_kill() -> sock_put() path. This creates a TOCTOU window: a concurrent close() on the target socket can call sock_put() and free the sk structure between read_unlock() and the callback invocation, causing the handler to dereference freed kernel memory. The fix, applied across multiple stable branches, adds sock_hold() while the socket is still on the list and sock_put() after the handler completes. Although CWE is listed as N/A in the source data, this vulnerability maps to CWE-416 (Use After Free) and CWE-362 (Concurrent Execution Using Shared Resource with Improper Synchronization).

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel: 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc4 (or later point releases), depending on the stable branch in use. Upstream fix commits are available at https://git.kernel.org/stable/c/4dc0e63abf8bc7ba8892e617c1fb8b204361e022, https://git.kernel.org/stable/c/1801cb20a5025a787d6853e19c38db138344b4b4, https://git.kernel.org/stable/c/c75a950e77356e526672cba4584080c6c8b793b6, https://git.kernel.org/stable/c/5595ea59cdf29182cf6a270cacc1426c57b603de, and https://git.kernel.org/stable/c/4fa349156043dc119721d067329714179f501749. Where immediate patching is not possible, unloading the AF_IUCV kernel module via 'modprobe -r af_iucv' eliminates the attack surface entirely - however, this disables all IUCV socket communication between z/VM guests, impacting any application relying on HiperSockets IPC (e.g., z/VM management tooling, IBM middleware). As a network-layer control, restricting HiperSockets guest LAN membership at the z/VM hypervisor level to only trusted guest partitions reduces the adjacent-network threat surface without disabling IUCV functionality, though this does not eliminate the vulnerability if a trusted guest is compromised.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55583 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy