CVE-2026-68140
net/iucv: fix use-after-free of a severed iucv_path
Description
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.
INFO
Published Date :
Aug. 10, 2026, 1:19 p.m.
Last Modified :
Aug. 13, 2026, 11:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Drop queued notifications when the path is severed.
- Free notifications when the path is gone.
- Update the Linux kernel to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-68140.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-68140 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-68140
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-68140 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-68140 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 13, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 10, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'f0703c80e5156406ad947cb67fe277725b48080f', 'lessThan': '23658b350b4107e8292045c2044983fd426fa15d', 'versionType': 'git'}, {'status': 'affected', 'version': 'f0703c80e5156406ad947cb67fe277725b48080f', 'lessThan': 'a5bbaddf69853117f28173c3f5c8fc14c6b2ec82', 'versionType': 'git'}, {'status': 'affected', 'version': 'f0703c80e5156406ad947cb67fe277725b48080f', 'lessThan': '900cd6d8119b7f3ae5c4bf82f922ff5957df43db', 'versionType': 'git'}, {'status': 'affected', 'version': 'f0703c80e5156406ad947cb67fe277725b48080f', 'lessThan': 'f579582c03ed526281a8450159baf1d35099a85f', 'versionType': 'git'}, {'status': 'affected', 'version': 'f0703c80e5156406ad947cb67fe277725b48080f', 'lessThan': 'be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a', 'versionType': 'git'}], 'programFiles': ['net/iucv/af_iucv.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.24'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.24', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/iucv/af_iucv.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued. Added Reference https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d Added Reference https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db Added Reference https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82 Added Reference https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a Added Reference https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f