CVE-2026-53306

A flaw was found in the Linux kernel. An off-by-one error in the hvc_iucv module can allow a local attacker to cause an out-of-bounds write. This memory corruption could lead to a denial of service (DoS) or potentially other impacts.

An off by one bounds check in hvc_iucv_get_private can allow hvc_iucv_table to be indexed one element past the end when the device counter reaches the maximum supported value. This is an out of bounds read of a kernel pointer table and may later lead to an invalid pointer dereference, causing a kernel crash or oops. For the CVSS the PR:L is used because a local user or local process context is needed to reach the hvc IUCV console path, while configuring the maximum number of devices is normally an administrative deployment condition. The issue is not network reachable and is specific to s390 z/VM IUCV hvc console configurations. Impact is primarily local denial of service, with only limited confidentiality concern in the paranoid score because the primitive is an out of bounds read rather than an overwrite.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.