CVE-2026-68397

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-68397
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68397.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-68397
Downstream
Published
2026-08-10T12:04:16Z
Modified
2026-08-21T03:30:44Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
net/iucv: take a reference on the socket found in afiucv_hs_rcv()
Details

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: take a reference on the socket found in afiucv_hs_rcv()

afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).

Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68397.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3881ac441f642d56503818123446f7298442236b
Fixed
5739be5c19495d709d902a2912c9102ce78740d5
Fixed
bc6c6e546ffff8865daaeb622ef348c2d481e80f
Fixed
e3e0679fc950191aff8f27fa78abcfc2462cff4a
Fixed
4dc0e63abf8bc7ba8892e617c1fb8b204361e022
Fixed
1801cb20a5025a787d6853e19c38db138344b4b4
Fixed
c75a950e77356e526672cba4584080c6c8b793b6
Fixed
5595ea59cdf29182cf6a270cacc1426c57b603de
Fixed
4fa349156043dc119721d067329714179f501749

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68397.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
3.2.0
Fixed
5.10.265
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.216
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.183
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.148
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.101
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.42
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.6

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-68397.json"