In the Linux kernel, the following vulnerability has been resolved:

net/iucv: fix locking in .getsockopt

Mirror iucv_sock_setsockopt() and wrap the whole switch in
lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock
becomes redundant and is removed.

Any AF_IUCV HIPER user can potentially crash the kernel by racing
recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences
iucv->hs_dev->mtu after iucv_sock_close() (called from the racing
recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference
oops.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00176.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
51363b8751a673a00ad48eea895266396d53fa52 affected < 884eb247b74d86db97e3a37f0d6fc8e1e83590dd
51363b8751a673a00ad48eea895266396d53fa52 affected < 45bb8de8c95d8899f4b8f61bd9bceb8132af73cb
51363b8751a673a00ad48eea895266396d53fa52 affected < 1fc30bd4e55e2dd622d2d366cecd732c1841bbee
51363b8751a673a00ad48eea895266396d53fa52 affected < cd691beafea0dd779e69e81ccc26b0ab50efcb5e
51363b8751a673a00ad48eea895266396d53fa52 affected < 6e792b8dd3002bbc4136745928a9605df1a72b8a
51363b8751a673a00ad48eea895266396d53fa52 affected < 9817369243380e287ebe5525411557eaa3aa2a79
51363b8751a673a00ad48eea895266396d53fa52 affected < 69554adc7a6fa04ede3ad7512321d83748e3c920
51363b8751a673a00ad48eea895266396d53fa52 affected < 3589d20a666caf30ad100c960a2de7de390fce88
Linux Linux affected
Version Status Constraints
3.4 affected —
0 unaffected < 3.4
5.10.259 unaffected ≤ 5.10.*
5.15.210 unaffected ≤ 5.15.*
6.1.176 unaffected ≤ 6.1.*
6.6.143 unaffected ≤ 6.6.*
6.12.93 unaffected ≤ 6.12.*
6.18.35 unaffected ≤ 6.18.*
7.0.12 unaffected ≤ 7.0.*
7.1 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/1fc30bd4e55e2dd622d2d366cecd732c1841bbee cve-icon
https://git.kernel.org/stable/c/3589d20a666caf30ad100c960a2de7de390fce88 cve-icon
https://git.kernel.org/stable/c/45bb8de8c95d8899f4b8f61bd9bceb8132af73cb cve-icon
https://git.kernel.org/stable/c/69554adc7a6fa04ede3ad7512321d83748e3c920 cve-icon
https://git.kernel.org/stable/c/6e792b8dd3002bbc4136745928a9605df1a72b8a cve-icon
https://git.kernel.org/stable/c/884eb247b74d86db97e3a37f0d6fc8e1e83590dd cve-icon
https://git.kernel.org/stable/c/9817369243380e287ebe5525411557eaa3aa2a79 cve-icon
https://git.kernel.org/stable/c/cd691beafea0dd779e69e81ccc26b0ab50efcb5e cve-icon
History

Sun, 19 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.
Title net/iucv: fix locking in .getsockopt
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-19T14:56:20.895Z

Reserved: 2026-07-19T07:54:57.026Z

Link: CVE-2026-64004

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.