Medium [CVE-2026-68397] Linux kernel: Use-after-free in net/iucv can lead to denial of service

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference.

AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -> sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk->sk_data_ready() in afiucv_hs_callback_syn()).

Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run. The afiucv_hs_rcv() function fails to properly manage socket references.

This allows a local attacker to trigger a use-after-free vulnerability by concurrently closing a socket while it is being processed. Successful exploitation can lead to a system crash, resulting in a denial of service.

Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825.

Affected Red Hat products: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.

Affected products named by the advisory: Red Hat package: kernel-rt.