CVE-2026-68141 net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
A NULL pointer dereference in the Linux kernel's af_iucv module can cause a system crash when socket allocation fails during connection handling.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68141?
CVE-2026-68141 is a high-severity vulnerability in Linux, published on 10 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/af_iucv: fix NULL deref in afiucv_hs_callback_syn()
afiucv_hs_callback_syn() allocates the child socket with GFP_ATOMIC. If the allocation fails, nsk is NULL.
The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucv_sock_kill(nsk) in that path.
iucv_sock_kill() does not accept a NULL socket pointer and immediately dereferences sk via sock_flag(sk, SOCK_ZAPPED). When nsk is NULL, calling iucv_sock_kill(nsk) results in a NULL pointer dereference.
Only call iucv_sock_kill() when a child socket was successfully allocated.
Weakness: CWE-476
Which versions are affected by CVE-2026-68141?
How do I fix CVE-2026-68141?
Apply the vendor's patch.
Is CVE-2026-68141 being exploited?
There is no known exploitation of CVE-2026-68141 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-68141, DEBIAN-CVE-2026-68141, GHSA-p635-m8r7-fc75, UBUNTU-CVE-2026-68141.