CVE-2026-68141: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
In the Linux kernel, the following vulnerability has been resolved:
net/afiucv: fix NULL deref in afiucvhscallbacksyn()
afiucvhscallbacksyn() allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL.
The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucvsockkill(nsk) in that path.
iucvsockkill() does not accept a NULL socket pointer and immediately dereferences sk via sockflag(sk, SOCKZAPPED). When nsk is NULL, calling iucvsockkill(nsk) results in a NULL pointer dereference.
Only call iucvsockkill() when a child socket was successfully allocated.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68141?
CVE-2026-68141 has a risk rating of 27.
What type of vulnerability is CVE-2026-68141?
CVE-2026-68141 is classified as a Null Pointer Dereference vulnerability.
How does CVE-2026-68141 affect the Linux kernel?
CVE-2026-68141 can lead to a NULL dereference in the function afiucv_hs_callback_syn() during socket allocation.
What systems are affected by CVE-2026-68141?
CVE-2026-68141 affects versions of the Linux kernel that utilize the net/af_iucv networking subsystem.
How do I fix CVE-2026-68141?
To fix CVE-2026-68141, update your Linux kernel to a patched version that addresses this NULL dereference issue.