Cloudanix VulnDB

CVE-2026-68397

High · 8.8

CVSS

8.8

EPSS

0.3%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in Linux networking code can let an attacker on the local network crash the system or run malicious code by exploiting a timing issue when connections close.

Exploitation
Adjacent Network
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in afiucv_hs_rcv() due to socket lookup under lock, lock release, then handler invocation without sock_hold(); concurrent close via iucv_sock_kill frees the socket before sk_data_ready or similar dereferences.

Why it matters to the business

Remote code execution or kernel crash on Linux systems using AF_IUCV sockets, potentially disrupting networked applications or allowing privilege escalation with adjacent network access.

How an attack unfolds

An attacker on the same network segment sends crafted AF_IUCV traffic to trigger the receive path, races a concurrent socket close to free the structure, then reuses the dangling pointer for arbitrary kernel memory access or control flow hijack.

How to fix it

Apply the upstream fix that adds sock_hold before dropping the list lock and sock_put after the callback completes; rebuild and deploy the patched kernel image; reboot affected systems.

How to confirm the fix worked

Verify kernel source contains the sock_hold/sock_put pair around afiucv_hs_callback_* calls; confirm running kernel version includes the commit resolving the race; run targeted socket stress tests exercising concurrent close during hs_rcv.

Typical attack path

  1. Identify Linux host exposing AF_IUCV sockets on adjacent network
  2. Send initial SYN-like IUCV frame to enter afiucv_hs_rcv lookup
  3. Trigger concurrent close from another context to free socket between unlock and handler
  4. Dereference freed sk->sk_data_ready or equivalent in callback to corrupt kernel state
  5. Escalate to code execution or denial of service

How to detect it

Review kernel logs for oops or panic mentioning iucv or afiucv_hs; inspect auditd or syscall traces for unusual socket close sequences during receive handling; correlate network flows with process termination events on IUCV ports.

What your security team should do

  • Prioritize patching any Linux kernel exposing AF_IUCV within the next maintenance window given high CVSS
  • Monitor EPSS trend and threat actor activity; reassess if exploitation maturity increases
  • Harden or disable AF_IUCV sockets where not required to reduce attack surface
  • Include kernel update in standard image rebuild pipelines

The record

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()). Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.

Affected packages

Ecosystem Package Introduced Fixed