Off-by-One Vulnerability in Linux Kernel's HVC IUCV Driver

CVE-2026-53306

What is CVE-2026-53306?

In the Linux kernel's hvc_iucv driver, an off-by-one vulnerability allows potential improper access to the hvc_iucv_table array. The maximum number of lines is specified by MAX_HVC_IUCV_LINES, yet a mistake in checking the device counter can lead to out-of-bounds access. When hvc_iucv_devices equals eight, the control flows incorrectly allow access to hvc_iucv_table[8], creating a security risk. This flaw has been addressed in subsequent kernel updates.

References