Improper Reference Management in Linux Kernel's AF_IUCV Sockets

CVE-2026-68397

What is CVE-2026-68397?

This vulnerability in the Linux kernel pertains to improper reference management involving AF_IUCV sockets. The issue arises in the function afiucv_hs_rcv(), where a reference to a socket is not appropriately held while it is passed to callback handlers. As AF_IUCV sockets are not protected by RCU, there exists a race condition that can lead to dereferencing freed memory due to concurrent socket closure. The absence of a proper reference can result in unstable behavior and potential security risks, necessitating immediate attention and patching.

References