CVE-2026-68141: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68141 Overview

CVE-2026-68141 is a NULL pointer dereference vulnerability in the Linux kernel's net/af_iucv subsystem. The flaw resides in the afiucv_hs_callback_syn() function, which allocates a child socket using GFP_ATOMIC. When the allocation fails, the resulting socket pointer nsk is NULL, but the connection-refused path unconditionally calls iucv_sock_kill(nsk). Because iucv_sock_kill() immediately dereferences the socket via sock_flag(sk, SOCK_ZAPPED), the NULL pointer triggers a kernel crash.

Critical Impact
A remote, unauthenticated attacker can trigger a kernel NULL pointer dereference in the IUCV (Inter-User Communication Vehicle) networking path, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel builds that include the net/af_iucv module (primarily IBM Z / s390x architecture)
Distributions shipping vulnerable stable kernel branches prior to the referenced upstream fixes
Systems with IUCV networking enabled and reachable over the network

Discovery Timeline

2026-08-10 - CVE-2026-68141 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68141

Vulnerability Analysis

The vulnerability exists in the IUCV address family handler for shared-transport (hs) connection setup. When a SYN-like connection request arrives, afiucv_hs_callback_syn() attempts to create a child socket for the new connection using GFP_ATOMIC, which is required in softirq or atomic contexts but does not guarantee success under memory pressure.

If the allocation returns NULL, control flow falls through to the connection-refused path. This same path is entered under three conditions: the parent socket is not in the listen state, the accept backlog is full, or nsk is NULL. The refused path unconditionally invokes iucv_sock_kill(nsk) to tear down the would-be child socket.

The iucv_sock_kill() routine does not validate its argument. It calls sock_flag(sk, SOCK_ZAPPED), which dereferences sk to read the socket flags. When sk is NULL, this dereference triggers a kernel oops and destabilizes the system.

Root Cause

The root cause is missing input validation on a shared cleanup path. The connection-refused branch reuses iucv_sock_kill() for two distinct scenarios: legitimate teardown of a successfully allocated child socket and error handling when allocation failed. The function was never designed to accept NULL, so the merged code path introduces an unchecked NULL dereference [CWE-476].

Attack Vector

An unauthenticated remote attacker can send crafted IUCV connection-request packets to a target that exposes the af_iucv shared transport. By generating memory pressure or high connection rates, the attacker can force GFP_ATOMIC allocations to fail during SYN handling, driving the kernel down the vulnerable refused path and causing a NULL pointer dereference. The result is a kernel crash and denial of service on the host.

No verified exploit code is publicly available. Refer to the upstream kernel commits (Kernel Git Commit 47a5116 and Kernel Git Commit 8bb111f8) for technical details of the fix.

Detection Methods for CVE-2026-68141

Indicators of Compromise

Kernel oops or panic messages referencing iucv_sock_kill, afiucv_hs_callback_syn, or sock_flag in dmesg or /var/log/kern.log
Unexpected reboots or hangs on IBM Z / s390x systems running IUCV-enabled workloads
Spikes in inbound IUCV SYN traffic correlated with kernel instability

Detection Strategies

Monitor kernel logs for NULL pointer dereference stack traces containing the af_iucv call chain.
Audit installed kernel packages against the fixed versions referenced in the upstream stable commits.
Track memory-pressure metrics on systems exposing IUCV, since exploitation depends on GFP_ATOMIC allocation failure.

Monitoring Recommendations

Enable kdump and persistent kernel crash logging to capture oops traces for post-incident analysis.
Alert on repeated kernel crashes involving networking subsystems across s390x hosts.
Correlate network flow telemetry with kernel panic events to detect targeted DoS attempts.

How to Mitigate CVE-2026-68141

Immediate Actions Required

Apply the upstream kernel patches or vendor-supplied updates that add a NULL check before invoking iucv_sock_kill() on the refused path.
Restrict network exposure of IUCV interfaces to trusted management networks only.
If patching is not immediately possible, disable the af_iucv module on hosts that do not require IUCV networking.

Patch Information

The fix modifies the connection-refused path so that iucv_sock_kill() is only called when the child socket was successfully allocated. Patches are available in the following upstream commits: Kernel Git Commit 0e857185, Kernel Git Commit 33736ff5, Kernel Git Commit 46453b1, Kernel Git Commit 47a5116, and Kernel Git Commit 8bb111f8. Rebuild and reboot into the fixed kernel to apply the change.

Workarounds

Blacklist the af_iucv kernel module on systems that do not use IUCV to eliminate the vulnerable code path.
Apply network filtering to block untrusted sources from reaching IUCV endpoints on IBM Z hosts.
Reduce memory pressure on affected systems to lower the probability of GFP_ATOMIC allocation failure until a patched kernel is deployed.

bash

# Disable the af_iucv module until the patched kernel is deployed
echo "blacklist af_iucv" | sudo tee /etc/modprobe.d/disable-af_iucv.conf
sudo rmmod af_iucv 2>/dev/null || true

# Verify the running kernel version after applying the vendor patch
uname -r