CVE-2026-53306tty: hvc_iucv: fix off-by-one in number of supported devices
Updated under an hour ago ()
Does this affect you?
It affects Linux and 1 other product. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Analyzed
- Record last updated
- Jun 26, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 44a01d5ba8a4d543694461cd3e178cfa6b3f221b builds before 3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before 484357dff256c816d9466bda35eb765685e4dc86; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before 11207e42a332eb8bbcb9fe74df9edd2a807c5607; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before a76511bc654819425d3b15e77b523d7f9d81f064; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before 3104a3f40feb107f77d7116ad9bf6c210ab7babf; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before f1dc8e72de9aabe5d96767a4e97219ac26b79fe5; from 44a01d5ba8a4d543694461cd3e178cfa6b3f221b before f2a880e802ad12d1e38039d1334fb1475d0f5241 | CNA record |
linux linux_kernel linux:linux_kernel | from 2.6.29 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10 | NVD |
References
- https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dffpatch
- https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86patch
- https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607patch
- https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4patch
- https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064patch
- https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babfpatch
- https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5patch
- https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241patch
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.