In the Linux kernel, the following vulnerability has been resolved:

net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC.
If the allocation fails, nsk is NULL.

The connection-refused path is entered when the listen state check
fails, the accept backlog is full, or nsk is NULL. The code
unconditionally calls iucv_sock_kill(nsk) in that path.

iucv_sock_kill() does not accept a NULL socket pointer and immediately
dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL,
calling iucv_sock_kill(nsk) results in a NULL pointer dereference.

Only call iucv_sock_kill() when a child socket was successfully
allocated.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
3881ac441f642d56503818123446f7298442236b affected < 8bb111f87ded6acb9837ec9b45d6f02cda94c51f
3881ac441f642d56503818123446f7298442236b affected < 46453b16f38ec7147351f7447e2aec6ea330f7b3
3881ac441f642d56503818123446f7298442236b affected < 33736ff5e7c97d3348ce812e8bd2e125d840743c
3881ac441f642d56503818123446f7298442236b affected < 0e857185591fe79934427c9c0c1c31dc776be134
3881ac441f642d56503818123446f7298442236b affected < 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4
Linux Linux affected
Version Status Constraints
3.2 affected —
0 unaffected < 3.2
6.6.148 unaffected ≤ 6.6.*
6.12.101 unaffected ≤ 6.12.*
6.18.42 unaffected ≤ 6.18.*
7.1.6 unaffected ≤ 7.1.*
7.2-rc5 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0e857185591fe79934427c9c0c1c31dc776be134 cve-icon
https://git.kernel.org/stable/c/33736ff5e7c97d3348ce812e8bd2e125d840743c cve-icon
https://git.kernel.org/stable/c/46453b16f38ec7147351f7447e2aec6ea330f7b3 cve-icon
https://git.kernel.org/stable/c/47a5116e56a6b6fe1e909f244e39cd0fc26ceee4 cve-icon
https://git.kernel.org/stable/c/8bb111f87ded6acb9837ec9b45d6f02cda94c51f cve-icon
History

Mon, 10 Aug 2026 14:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Mon, 10 Aug 2026 12:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path. iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference. Only call iucv_sock_kill() when a child socket was successfully allocated.
Title net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-10T11:59:05.051Z

Reserved: 2026-07-30T09:28:09.370Z

Link: CVE-2026-68141

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-10T14:15:03Z

Weaknesses