CVE-2026-68140: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68140 Overview

CVE-2026-68140 is a use-after-free vulnerability in the Linux kernel's net/iucv subsystem, which implements the Inter-User Communication Vehicle (IUCV) transport used on IBM Z (s390) systems. The af_iucv socket family queues not-yet-received message notifications on iucv->message_q, and each notification holds a raw pointer to the connection's iucv_path. When the remote peer severs the connection, iucv_sever_path() frees that path via iucv_path_free() but leaves the queued notifications intact. A subsequent recvmsg() call drains message_q through iucv_process_message_q() and passes the stale path to message_receive(), dereferencing freed memory.

Critical Impact
An adjacent peer can trigger a kernel use-after-free by severing an IUCV connection while messages remain queued, enabling potential kernel memory corruption and code execution.

Affected Products

Linux kernel builds that enable the af_iucv socket family (CONFIG_AF_IUCV)
IBM Z / s390 and s390x distributions using IUCV networking
Multiple stable kernel branches referenced by the upstream fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68140 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68140

Vulnerability Analysis

The defect lives in the af_iucv socket implementation. Incoming message notifications are queued on the per-socket iucv->message_q while userspace has not yet issued a recvmsg(). Each queued entry stores a raw pointer back to the associated iucv_path structure.

When the peer severs the IUCV link, the kernel invokes iucv_sever_path() and releases the path with iucv_path_free(). The queued notifications are not drained at this point, so they retain dangling references. When userspace later calls recvmsg(), iucv_process_message_q() walks the queue and hands each stale pointer to message_receive(), which dereferences memory that has already been freed. The same defect also leaks the queued notifications when a socket is closed while messages remain queued.

Root Cause

The root cause is a lifetime mismatch between iucv_path objects and the notifications that reference them. The sever path releases the path without invalidating dependents on message_q, violating the invariant that queued notifications only reference live paths. This is a classic Use After Free [CWE-416] in kernel networking code.

Attack Vector

Exploitation requires an adjacent IUCV peer that can establish a connection to a vulnerable socket, deliver messages that remain queued, and then sever the path before the receiver drains the queue. The attack surface is limited to systems with af_iucv enabled, which is typical on IBM Z guests communicating over z/VM IUCV or HiperSockets IUCV. Successful exploitation can corrupt slab memory containing the freed iucv_path and, depending on heap grooming, lead to kernel memory disclosure, denial of service, or privilege escalation.

No public proof-of-concept has been published. The verified upstream fix drops any queued notifications when a path is severed, ensuring that stale pointers can never be dereferenced. See the upstream commits 23658b3, 900cd6d8, a5bbaddf, be7cc465, and f579582c for the corrective changes.

Detection Methods for CVE-2026-68140

Indicators of Compromise

Kernel oops or panic messages referencing iucv_process_message_q, message_receive, or iucv_sever_path in dmesg and journal logs.
KASAN or SLUB debug reports flagging use-after-free on the iucv_path slab following an IUCV sever event.
Unexpected socket state transitions on AF_IUCV sockets shortly before a crash on IBM Z guests.

Detection Strategies

Enable KASAN on test kernels to catch dereferences of freed iucv_path objects during fuzzing of af_iucv connect, sever, and recvmsg sequences.
Correlate kernel crash telemetry with IUCV connection sever events across z/VM guests to identify repeated fault patterns tied to specific peers.
Track AF_IUCV socket usage on hosts that do not require IUCV; unexpected use of this family warrants investigation.

Monitoring Recommendations

Forward kernel logs from s390/s390x systems to a central SIEM and alert on stack traces containing iucv_ symbols.
Monitor for abnormal frequencies of IUCV path establishment and sever operations from a single peer, which may indicate exploitation attempts.
Track kernel package versions across the fleet to confirm systems have received the upstream fix.

How to Mitigate CVE-2026-68140

Immediate Actions Required

Apply the latest stable kernel update from your distribution that incorporates the upstream net/iucv fix commits listed in the references.
Inventory IBM Z and s390x systems and identify those with CONFIG_AF_IUCV enabled or the af_iucv module loaded.
Restrict IUCV peer authorizations in z/VM directory entries to trusted guests only, reducing the adjacent attack surface.

Patch Information

The fix drops queued notifications when the associated path is severed. Merge or backport the changes in commits 23658b35, 900cd6d8, a5bbaddf, be7cc465, and f579582c from the stable kernel tree. Distribution kernels including Red Hat Enterprise Linux for IBM Z, SUSE Linux Enterprise Server for IBM Z, and Ubuntu s390x builds will ship the fix through their standard security update channels.

Workarounds

If IUCV networking is not required, unload the module with modprobe -r af_iucv and blacklist it to prevent reload.
Constrain IUCV connectivity through z/VM IUCV directory statements so only vetted guests can establish paths.
Where possible, prefer HiperSockets or standard TCP/IP transports over AF_IUCV on affected systems until patched.

bash

# Disable the af_iucv module on systems that do not require IUCV
sudo modprobe -r af_iucv
echo "blacklist af_iucv" | sudo tee /etc/modprobe.d/blacklist-af_iucv.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep af_iucv