CVE-2026-68141
Received Received - Intake

NULL Pointer Dereference in Linux Kernel af_iucv

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path. iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference. Only call iucv_sock_kill() when a child socket was successfully allocated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68141
EUVD
EUVD-2026-55523

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a NULL pointer dereference vulnerability in the Linux kernel's af_iucv module. The function afiucv_hs_callback_syn() allocates a child socket with GFP_ATOMIC. If allocation fails, the socket pointer becomes NULL. The code then unconditionally calls iucv_sock_kill(nsk) which dereferences the NULL pointer, causing a kernel crash.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the Linux kernel's af_iucv module. Detection requires checking for kernel crashes or NULL pointer dereference errors in system logs, particularly related to af_iucv or iucv_sock_kill functions. Monitor logs for kernel oops messages or segmentation faults involving these components.

Impact Analysis

This vulnerability can cause a kernel panic leading to system crashes. If exploited, it could result in denial of service for the affected system. Systems using the af_iucv module are particularly at risk.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. If immediate patching is not possible, consider disabling the af_iucv module if it is not required for your system's operations to prevent exploitation of this flaw.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart