CVE-2026-99133: net/iucv: fix the recvmsg window update

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: fix the recvmsg window update

iucvsockrecvmsg() sends the HiperSockets-only AFIUCVFLAGWIN without testing the transport, so on a classic z/VM socket iucvsendctrl() sizes the skb through a NULL iucv->hsdev. SOMSGLIMIT accepts 1, so msglimit / 2 is zero and one recvmsg() on its own socket is enough for an unprivileged process to take a spurious disconnect.

It also calls iucvsendctrl() under spinlockbh(&messageq.lock), which allocates GFPKERNEL inside a section the code treats as atomic. Sending outside that lock lets two recvmsg() reach afiucvhssend() at once, where msgrecv is sampled for the advertised window and subtracted after devqueuexmit() -- and sendmsg reaches that counter under locksock() while recvmsg holds no socket lock, so both can subtract the same value, the counter goes negative and the credit reaches the peer twice.

Test the transport, claim the credit with atomicxchg() after the last error exit and hand it back if the transmit fails, and send once the lock is dropped.