Locking Flaw in Linux Kernel's IUCV Implementation Allows Potential Kernel Crash

CVE-2026-64004

What is CVE-2026-64004?

A critical vulnerability in the Linux kernel's IUCV implementation allows users utilizing AF_IUCV to potentially crash the kernel. This issue arises due to improper locking around socket option calls, specifically in the getsockopt function. When a recvmsg call is executed concurrently with getsockopt(SO_MSGSIZE), a race condition occurs, leading to a NULL pointer dereference following the closure of the socket. This vulnerability can disrupt system stability, and it is imperative for users to apply the necessary patches to mitigate this risk.

References