CVE-2026-81003

A flaw was found in the Linux kernel's AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The afiucv_hs_rcv() function, responsible for receiving frames, does not properly filter incoming frames based on the ingress network device. This oversight allows a local attacker with specific network capabilities or a host on the same HiperSockets segment to send specially crafted frames. Successful exploitation can lead to a Denial of Service (DoS) by exhausting the accept-queue, injecting data into existing sockets, and disrupting established connections.

A flaw rated IMPORTANT by Red Hat Product Security was found in the Linux kernel's AF_IUCV protocol implementation, used for the z/VM IUCV and HiperSockets transports on the s390x (IBM Z) architecture. The afiucv_hs_rcv() receive path selected a target socket from the global socket list by matching only the four 8-byte name fields in the frame's transport header, without checking the network device the frame arrived on. As a result, a frame received on any network device could be delivered to an AF_IUCV socket bound to a different device or to the classic z/VM IUCV transport. A local attacker holding only the CAP_NET_RAW capability inside an unprivileged user and network namespace could send a raw ETH_P_AF_IUCV frame on its own loopback device and have it matched against sockets in the initial network namespace; similarly, a host on the same shared HiperSockets segment could direct frames at sockets bound to a different HiperSockets device. Successful exploitation could exhaust a listening socket's accept queue (denial of service), inject data into existing AF_IUCV connections, control the peer identity of accepted child sockets, and disrupt or kill established connections. Multiple Red Hat Enterprise Linux kernel and kernel-rt update streams and Red Hat In-Vehicle OS kernel streams are affected, and fixes are being pursued in the respective product streams; the kernel-ivos-qualcomm component of Red Hat In-Vehicle OS is not affected because the vulnerable code is not present in that kernel. The Red Hat severity of IMPORTANT (CVSS 3.1 score 7.0, AV:L/AC:H/PR:L) is lower than the upstream CVE.org rating of 8.1 (AV:A/AC:L/PR:N): Red Hat assessed the dominant exploitation path as local, requiring privileges and high attack complexity, whereas the upstream rating emphasizes the adjacent-network HiperSockets vector requiring no privileges. Note that AF_IUCV over HiperSockets provides no per-connection authentication, so the fix reduces the attack surface to peers present on the same HiperSockets segment but does not change that protocol-level property.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.