Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-68141— net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于net/af_iucv中afiucv_hs_callback_syn()函数在子套接字分配失败时，调用iucv_sock_kill(nsk)导致空指针取消引用。

CVSS 7.5 · High EPSS 0.52% · P43

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 3881ac441f642d56503818123446f7298442236b< 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1 affected
3881ac441f642d56503818123446f7298442236b< c0b6e2ae90613c2fea7eaf3faa20985c6c2a1953 affected
3881ac441f642d56503818123446f7298442236b< 07e21deb3664001995e0a456dd627ab7dbe127ec affected
3881ac441f642d56503818123446f7298442236b< 8bb111f87ded6acb9837ec9b45d6f02cda94c51f affected
3881ac441f642d56503818123446f7298442236b< 46453b16f38ec7147351f7447e2aec6ea330f7b3 affected
3881ac441f642d56503818123446f7298442236b< 33736ff5e7c97d3348ce812e8bd2e125d840743c affected
3881ac441f642d56503818123446f7298442236b< 0e857185591fe79934427c9c0c1c31dc776be134 affected
3881ac441f642d56503818123446f7298442236b< 47a5116e56a6b6fe1e909f244e39cd0fc26ceee4 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-68141

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net/af_iucv: fix NULL deref in afiucv_hs_callback_syn() afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL. The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path. iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference. Only call iucv_sock_kill() when a child socket was successfully allocated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于net/af_iucv中afiucv_hs_callback_syn()函数在子套接字分配失败时，调用iucv_sock_kill(nsk)导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3881ac441f642d56503818123446f7298442236b ~ 6a1eb5b46c19073f8153b7e2c19b408cf353aaf1 -
Linux Linux 3.2 -

II. Public POCs for CVE-2026-68141

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-68141

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-68141 (8)

Same Patch Batch · Linux · 2026-08-10 · 344 CVEs total

CVE-2026-68136 9.8 CRITICAL net: gro: fix double aggregation of flush-marked skbs
CVE-2026-68144 9.8 CRITICAL phonet: pep: fix use-after-free in pep_get_sb()
CVE-2026-68127 9.8 CRITICAL ila: reload IPv6 header after pskb_may_pull in checksum adjust
CVE-2026-68302 9.8 CRITICAL amt: re-read skb header pointers after every pull
CVE-2026-68154 9.8 CRITICAL libceph: reject zero bucket types in crush_decode
CVE-2026-68156 9.8 CRITICAL libceph: refresh auth->authorizer_buf{,_len} after authorizer update
CVE-2026-68158 9.8 CRITICAL libceph: Fix multiplication overflow in decode_new_up_state_weight()
CVE-2026-68159 9.8 CRITICAL libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE
CVE-2026-68160 9.8 CRITICAL ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps()
CVE-2026-68300 9.8 CRITICAL sctp: auth: verify auth requirement when auth_chunk is NULL
CVE-2026-68161 9.8 CRITICAL sctp: close UDP tunnel sockets during netns teardown
CVE-2026-68117 9.8 CRITICAL tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
CVE-2026-68388 9.8 CRITICAL smb/client: handle overlapping allocated ranges in fallocate
CVE-2026-68137 9.8 CRITICAL net/x25: fix use-after-free in x25_kill_by_neigh()
CVE-2026-68426 9.8 CRITICAL xfrm: fix stale skb->prev after async crypto steals a GSO segment
CVE-2026-68385 9.8 CRITICAL s390/checksum: Fix csum_partial() without vector facility
CVE-2026-68123 9.8 CRITICAL openvswitch: fix GSO userspace truncation underflow
CVE-2026-68381 9.8 CRITICAL ksmbd: pin conn during async oplock break notification
CVE-2026-68170 9.8 CRITICAL mptcp: fix stale skb->sk reference on subflow close
CVE-2026-68124 9.6 CRITICAL mctp: serial: handle zero-length frames to prevent rx buffer overflow

Showing top 20 of 344 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-68141

No comments yet

Leave a comment