CVE-2026-68140

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to memory corruption, potentially resulting in a system crash (denial of service) or allowing an attacker to execute arbitrary code.

A use-after-free flaw was found in the Linux kernel's net/iucv (AF_IUCV socket) implementation, rated IMPORTANT by Red Hat Product Security. The af_iucv implementation queues not-yet-received message notifications on a per-socket message queue, with each notification holding a raw pointer to the connection's iucv_path. When a peer severs the connection, iucv_sever_path() frees that path but leaves the queued notifications in place; a later recvmsg() drains the queue via iucv_process_message_q() and hands the stale pointer to message_receive(), resulting in a use-after-free of the freed iucv_path. A local attacker able to open and use AF_IUCV sockets could race a peer severing the connection against processing of the queued messages, causing kernel memory corruption that can result in a system crash (denial of service) or, potentially, execution of arbitrary code. Red Hat Enterprise Linux 6, 7, 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS are affected; fixes are being pursued through the respective kernel teams for the affected product streams. Red Hat Product Security scored this flaw CVSS 3.1 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), lower than the upstream CVEORG score of 8.8 (AV:A/AC:L/PR:N), because successful exploitation requires local access with the ability to create AF_IUCV socket connections and depends on high attack complexity due to the timing-sensitive race between connection severing and message queue processing.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The upstream Linux kernel community recommends updating to a stable kernel release containing the fix (6.6.148, 6.12.101, 6.18.42, or 7.1.6 depending on the stable series); for Red Hat products, apply the kernel updates provided for the affected product streams.