CVE-2026-64004

Analyzed Analyzed - Analysis Complete

Memory Corruption in Linux Kernel IUCV Socket

Publication date: 2026-07-19

Last updated on: 2026-10-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-08

Generated

2026-10-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-07

NVD

CVE-2026-64004

EUVD

EUVD-2026-45577

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 3.4 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a race condition in the AF_IUCV socket code can lead to a NULL pointer dereference. The issue occurs when getsockopt(SO_MSGSIZE) is called while recvmsg() is racing with iucv_sock_close(), causing a kernel crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's AF_IUCV HIPER socket implementation. Detection requires checking for kernel crashes or NULL pointer dereference errors in the iucv subsystem. Monitor system logs for oops messages or kernel panics related to AF_IUCV or iucv_sock_close. No direct commands are provided in the context to detect this issue.

Impact Analysis

An attacker with AF_IUCV HIPER privileges could exploit this to crash the kernel, leading to denial of service. Systems using AF_IUCV sockets may experience unexpected crashes or instability.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a kernel-level issue in the Linux AF_IUCV subsystem that could allow local users to crash the system via a race condition, but there is no evidence it involves data exposure, unauthorized access, or privacy violations that would impact regulatory compliance.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a kernel version that includes the fix for net/iucv locking in .getsockopt. Avoid using AF_IUCV HIPER sockets if possible until patched. Monitor vendor advisories for kernel updates addressing this CVE.

Hi! I’m here to help you understand CVE-2026-64004. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70