High · published July 19, 2026
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix locking in .getsockopt
Mirror iucv_sock_setsockopt() and wrap the whole switch in
lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock
becomes redundant and is removed.
Any AF_IUCV HIPER user can potentially crash the kernel by racing
recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences
iucv->hs_dev->mtu after iucv_sock_close() (called from the racing
recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference
oops.
| Product | Versions | Fixed in |
|---|---|---|
| linux/linux_kernel | ≥ 3.4, < 5.10.259 | 5.10.259 |
| linux/linux_kernel | ≥ 5.11, < 5.15.210 | 5.15.210 |
| linux/linux_kernel | ≥ 5.16, < 6.1.176 | 6.1.176 |
| linux/linux_kernel | ≥ 6.2, < 6.6.143 | 6.6.143 |
| linux/linux_kernel | ≥ 6.7, < 6.12.93 | 6.12.93 |
| linux/linux_kernel | ≥ 6.13, < 6.18.35 | 6.18.35 |
| linux/linux_kernel | ≥ 6.19, < 7.0.12 | 7.0.12 |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |
| linux/linux_kernel | all versions | — |