---
id: CVE-2026-68141
title: 'net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

  afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.
  If the allocation fails, nsk is NULL.

  The…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    6a1eb5b46c19073f8153b7e2c19b408cf353aaf1
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    07e21deb3664001995e0a456dd627ab7dbe127ec
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    8bb111f87ded6acb9837ec9b45d6f02cda94c51f
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    46453b16f38ec7147351f7447e2aec6ea330f7b3
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    33736ff5e7c97d3348ce812e8bd2e125d840743c
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    0e857185591fe79934427c9c0c1c31dc776be134
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    47a5116e56a6b6fe1e909f244e39cd0fc26ceee4
  - Linux 3.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-10-16T15:44:37.607380Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:52:59.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68141'
references:
  - url: 'https://git.kernel.org/stable/c/6a1eb5b46c19073f8153b7e2c19b408cf353aaf1'
  - url: 'https://git.kernel.org/stable/c/c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953'
  - url: 'https://git.kernel.org/stable/c/07e21deb3664001995e0a456dd627ab7dbe127ec'
  - url: 'https://git.kernel.org/stable/c/8bb111f87ded6acb9837ec9b45d6f02cda94c51f'
  - url: 'https://git.kernel.org/stable/c/46453b16f38ec7147351f7447e2aec6ea330f7b3'
  - url: 'https://git.kernel.org/stable/c/33736ff5e7c97d3348ce812e8bd2e125d840743c'
  - url: 'https://git.kernel.org/stable/c/0e857185591fe79934427c9c0c1c31dc776be134'
  - url: 'https://git.kernel.org/stable/c/47a5116e56a6b6fe1e909f244e39cd0fc26ceee4'
tags:
  - cve.org
epss: 0.00523
epssPercentile: 0.43128
ingestedAt: '2026-10-16T17:24:46.844Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.
If the allocation fails, nsk is NULL.

The connection-refused path is entered when the listen state check
fails, the accept backlog is full, or nsk is NULL. The code
unconditionally calls iucv_sock_kill(nsk) in that path.

iucv_sock_kill() does not accept a NULL socket pointer and immediately
dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL,
calling iucv_sock_kill(nsk) results in a NULL pointer dereference.

Only call iucv_sock_kill() when a child socket was successfully
allocated.

## Affected

- `Linux >= 3881ac441f642d56503818123446f7298442236b < 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 07e21deb3664001995e0a456dd627ab7dbe127ec`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 8bb111f87ded6acb9837ec9b45d6f02cda94c51f`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 46453b16f38ec7147351f7447e2aec6ea330f7b3`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 33736ff5e7c97d3348ce812e8bd2e125d840743c`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 0e857185591fe79934427c9c0c1c31dc776be134`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.