CVE-2026-64004: Linux Kernel Race Condition Vulnerability

CVE-2026-64004 Overview

CVE-2026-64004 is a race condition vulnerability in the Linux kernel's AF_IUCV (Inter-User Communication Vehicle) socket implementation on IBM Z systems. The flaw exists in the iucv_sock_getsockopt() function within net/iucv, where insufficient locking allows a local user to trigger a NULL pointer dereference. Any AF_IUCV HIPER (High Performance) user can crash the kernel by racing recvmsg() against getsockopt(SO_MSGSIZE). The upstream fix mirrors iucv_sock_setsockopt() by wrapping the entire switch in lock_sock()/release_sock(), eliminating the race window.

Critical Impact
A local unprivileged user with AF_IUCV socket access can trigger a kernel NULL pointer dereference, resulting in a denial-of-service through kernel oops.

Affected Products

Linux kernel (net/iucv subsystem)
IBM Z / s390x systems using AF_IUCV HIPER sockets
Distributions shipping vulnerable stable kernel branches prior to the referenced patch commits

Discovery Timeline

2026-07-19 - CVE-2026-64004 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64004

Vulnerability Analysis

The vulnerability resides in the iucv_sock_getsockopt() function in the Linux kernel's net/iucv module. Unlike its counterpart iucv_sock_setsockopt(), the getsockopt implementation did not hold the socket lock across its full switch statement. Only the SO_MSGLIMIT case acquired a lock, leaving other option handlers exposed to concurrent state changes.

When a user issues getsockopt(SO_MSGSIZE) on an AF_IUCV HIPER socket, the handler dereferences iucv->hs_dev->mtu. If recvmsg() runs concurrently on another thread and reaches iucv_sock_close(), it sets hs_dev to NULL. The getsockopt path then dereferences the NULL pointer, producing a kernel oops.

Root Cause

The root cause is inconsistent locking between the setsockopt and getsockopt handlers. The getsockopt path lacked lock_sock() protection across the switch, allowing the socket state field hs_dev to be torn down mid-read. This is a classic race condition [CWE-362] combined with a NULL pointer dereference [CWE-476].

Attack Vector

Exploitation requires local access and the ability to open AF_IUCV sockets, which is available to unprivileged users on affected s390x systems. The attacker creates an AF_IUCV HIPER socket and spawns two threads: one calling recvmsg() repeatedly to trigger socket close paths, and another calling getsockopt(SO_MSGSIZE) in a tight loop. Winning the race causes the kernel to dereference a NULL hs_dev pointer, panicking the kernel or destabilizing the system.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream patch commits referenced by the Kernel Git Commit 1fc30bd4 and related backports.

Detection Methods for CVE-2026-64004

Indicators of Compromise

Kernel oops messages in dmesg or /var/log/kern.log referencing iucv_sock_getsockopt or NULL pointer dereference in the net/iucv code path
Unexpected system crashes or panics on s390x hosts running AF_IUCV workloads
Repeated getsockopt and recvmsg syscalls from the same process against AF_IUCV sockets

Detection Strategies

Audit running kernel version against the fixed commits listed in the upstream kernel git references
Monitor kernel crash dumps for stack traces containing iucv_sock_getsockopt, hs_dev, or afiucv_hs_getsockopt
Use auditd rules to log socket() calls with AF_IUCV family from non-system accounts

Monitoring Recommendations

Enable kernel crash collection (kdump) on s390x systems to capture oops traces for post-incident analysis
Track process behavior for tight loops calling getsockopt with SO_MSGSIZE on AF_IUCV sockets
Alert on kernel panic events forwarded from syslog into centralized logging or SIEM platforms

How to Mitigate CVE-2026-64004

Immediate Actions Required

Apply the upstream Linux kernel patches from the referenced stable branch commits and reboot affected s390x hosts
Inventory all IBM Z / s390x systems and identify workloads that rely on AF_IUCV HIPER sockets
Restrict local shell access on affected systems until patched kernels are deployed

Patch Information

The fix wraps the entire iucv_sock_getsockopt() switch statement in lock_sock()/release_sock(), mirroring the locking pattern already used in iucv_sock_setsockopt(). The prior redundant SO_MSGLIMIT-only lock is removed. Patches are available across multiple stable kernel branches through commits 1fc30bd4, 3589d20, 45bb8de, 69554ad, 6e792b8, 884eb24, 9817369, and cd691be. Consult your Linux distribution's security advisory for backported package versions.

Workarounds

Disable or blacklist the af_iucv kernel module on systems that do not require IUCV networking
Limit AF_IUCV socket creation to trusted service accounts using SELinux or AppArmor policies
Constrain untrusted local users on s390x hosts through mandatory access controls until patching completes

bash

# Blacklist the af_iucv module to prevent loading on systems that do not need it
echo 'blacklist af_iucv' | sudo tee /etc/modprobe.d/blacklist-af_iucv.conf
sudo rmmod af_iucv 2>/dev/null || true

# Verify the running kernel version and confirm patch status
uname -r
rpm -q --changelog kernel | grep -i iucv | head -20