---
id: CVE-2026-68397
title: 'net/iucv: take a reference on the socket found in afiucv_hs_rcv()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/iucv: take a reference on the socket found in afiucv_hs_rcv()

  afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,
  drops the lock, and then pas…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    5739be5c19495d709d902a2912c9102ce78740d5
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    bc6c6e546ffff8865daaeb622ef348c2d481e80f
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    e3e0679fc950191aff8f27fa78abcfc2462cff4a
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    4dc0e63abf8bc7ba8892e617c1fb8b204361e022
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    1801cb20a5025a787d6853e19c38db138344b4b4
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    c75a950e77356e526672cba4584080c6c8b793b6
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    5595ea59cdf29182cf6a270cacc1426c57b603de
  - >-
    Linux >= 3881ac441f642d56503818123446f7298442236b <
    4fa349156043dc119721d067329714179f501749
  - Linux 3.2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:48:06.325018Z'
published: '2026-08-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:11.580Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68397'
references:
  - url: 'https://git.kernel.org/stable/c/5739be5c19495d709d902a2912c9102ce78740d5'
  - url: 'https://git.kernel.org/stable/c/bc6c6e546ffff8865daaeb622ef348c2d481e80f'
  - url: 'https://git.kernel.org/stable/c/e3e0679fc950191aff8f27fa78abcfc2462cff4a'
  - url: 'https://git.kernel.org/stable/c/4dc0e63abf8bc7ba8892e617c1fb8b204361e022'
  - url: 'https://git.kernel.org/stable/c/1801cb20a5025a787d6853e19c38db138344b4b4'
  - url: 'https://git.kernel.org/stable/c/c75a950e77356e526672cba4584080c6c8b793b6'
  - url: 'https://git.kernel.org/stable/c/5595ea59cdf29182cf6a270cacc1426c57b603de'
  - url: 'https://git.kernel.org/stable/c/4fa349156043dc119721d067329714179f501749'
tags:
  - cve.org
epss: 0.00262
epssPercentile: 0.1684
ingestedAt: '2026-10-16T17:24:46.863Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: take a reference on the socket found in afiucv_hs_rcv()

afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock,
drops the lock, and then passes the socket to the afiucv_hs_callback_*()
handlers without holding a reference. AF_IUCV sockets are not
RCU-protected and are freed synchronously by iucv_sock_kill() ->
sock_put(), so a concurrent close can free the socket in the window
between read_unlock() and the handler, which then dereferences freed
memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).

Take a reference with sock_hold() while the socket is still on the list
and release it with sock_put() once the handler has run.

## Affected

- `Linux >= 3881ac441f642d56503818123446f7298442236b < 5739be5c19495d709d902a2912c9102ce78740d5`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < bc6c6e546ffff8865daaeb622ef348c2d481e80f`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < e3e0679fc950191aff8f27fa78abcfc2462cff4a`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 4dc0e63abf8bc7ba8892e617c1fb8b204361e022`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 1801cb20a5025a787d6853e19c38db138344b4b4`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < c75a950e77356e526672cba4584080c6c8b793b6`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 5595ea59cdf29182cf6a270cacc1426c57b603de`
- `Linux >= 3881ac441f642d56503818123446f7298442236b < 4fa349156043dc119721d067329714179f501749`
- `Linux 3.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.