High 7.5Published Aug 10, 2026

CVE-2026-68141net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

Updated under an hour ago (Oct 27, 2026, 9:50 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path. iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference. Only call iucv_sock_kill() when a child socket was successfully allocated.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-476
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	3881ac441f642d56503818123446f7298442236b builds before 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1; from 3881ac441f642d56503818123446f7298442236b before c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953; 3881ac441f642d56503818123446f7298442236b builds before 07e21deb3664001995e0a456dd627ab7dbe127ec; 3881ac441f642d56503818123446f7298442236b builds before 8bb111f87ded6acb9837ec9b45d6f02cda94c51f; from 3881ac441f642d56503818123446f7298442236b before 46453b16f38ec7147351f7447e2aec6ea330f7b3; from 3881ac441f642d56503818123446f7298442236b before 33736ff5e7c97d3348ce812e8bd2e125d840743c; 3881ac441f642d56503818123446f7298442236b builds before 0e857185591fe79934427c9c0c1c31dc776be134; 3881ac441f642d56503818123446f7298442236b builds before 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4	CNA record

References

References

https://git.kernel.org/stable/c/6a1eb5b46c19073f8153b7e2c19b408cf353aaf1
https://git.kernel.org/stable/c/c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953
https://git.kernel.org/stable/c/07e21deb3664001995e0a456dd627ab7dbe127ec
https://git.kernel.org/stable/c/8bb111f87ded6acb9837ec9b45d6f02cda94c51f
https://git.kernel.org/stable/c/46453b16f38ec7147351f7447e2aec6ea330f7b3
https://git.kernel.org/stable/c/33736ff5e7c97d3348ce812e8bd2e125d840743c
https://git.kernel.org/stable/c/0e857185591fe79934427c9c0c1c31dc776be134
https://git.kernel.org/stable/c/47a5116e56a6b6fe1e909f244e39cd0fc26ceee4

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.