{"id":"CVE-2026-68140","title":"net/iucv: fix use-after-free of a severed iucv_path","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv->message_q,\neach holding a raw pointer to the connect…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 5f08c5e50bcb4680069bd3f9edd5728308816ded","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < c24faf11bd31bfe0500aca12cbdd5a573a954a5d","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 99ddb33748698296a6f17b9b34aa3d16a406bb3c","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 23658b350b4107e8292045c2044983fd426fa15d","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < a5bbaddf69853117f28173c3f5c8fc14c6b2ec82","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 900cd6d8119b7f3ae5c4bf82f922ff5957df43db","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < f579582c03ed526281a8450159baf1d35099a85f","Linux >= f0703c80e5156406ad947cb67fe277725b48080f < be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a","Linux 2.6.24"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:44:34.964555Z"},"published":"2026-08-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:52:59.281Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68140","references":[{"url":"https://git.kernel.org/stable/c/5f08c5e50bcb4680069bd3f9edd5728308816ded"},{"url":"https://git.kernel.org/stable/c/c24faf11bd31bfe0500aca12cbdd5a573a954a5d"},{"url":"https://git.kernel.org/stable/c/99ddb33748698296a6f17b9b34aa3d16a406bb3c"},{"url":"https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d"},{"url":"https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82"},{"url":"https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db"},{"url":"https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f"},{"url":"https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a"}],"tags":["cve.org"],"epss":0.00274,"epssPercentile":0.18458,"ingestedAt":"2026-10-16T17:24:46.843Z","slug":"CVE-2026-68140","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv->message_q,\neach holding a raw pointer to the connection's iucv_path.  When the peer\nsevers the connection, iucv_sever_path() frees that path with\niucv_path_free() but leaves the notifications queued.  A later recvmsg()\ndrains message_q via iucv_process_message_q() and hands the stale path to\nmessage_receive() -- a use-after-free of the freed iucv_path.\n\nDrop the queued notifications when the path is severed; once the path is\ngone they can no longer be received.  This also frees the notifications\nleaked when a socket is closed with messages still queued.\n\n## Affected\n\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 5f08c5e50bcb4680069bd3f9edd5728308816ded`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < c24faf11bd31bfe0500aca12cbdd5a573a954a5d`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 99ddb33748698296a6f17b9b34aa3d16a406bb3c`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 23658b350b4107e8292045c2044983fd426fa15d`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < a5bbaddf69853117f28173c3f5c8fc14c6b2ec82`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < 900cd6d8119b7f3ae5c4bf82f922ff5957df43db`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < f579582c03ed526281a8450159baf1d35099a85f`\n- `Linux >= f0703c80e5156406ad947cb67fe277725b48080f < be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a`\n- `Linux 2.6.24`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}