CVE-2026-68397: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68397 Overview

CVE-2026-68397 is a use-after-free vulnerability in the Linux kernel's net/iucv subsystem. The flaw resides in the afiucv_hs_rcv() function, which looks up destination sockets under iucv_sk_list.lock, then releases the lock before invoking afiucv_hs_callback_*() handlers without holding a socket reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() calling sock_put(). A concurrent socket close can free the object between read_unlock() and the handler, causing the handler to dereference freed memory such as sk->sk_data_ready() in afiucv_hs_callback_syn().

Critical Impact
A race condition between socket lookup and handler execution allows use-after-free of AF_IUCV socket memory, enabling kernel memory corruption from adjacent network access.

Affected Products

Linux kernel (upstream mainline)
Linux kernel stable branches containing net/iucv AF_IUCV socket support
Linux distributions running on IBM Z (s390/s390x) architectures using IUCV networking

Discovery Timeline

2026-08-10 - CVE-2026-68397 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68397

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] race condition in the AF_IUCV socket receive path. afiucv_hs_rcv() performs a socket lookup while holding iucv_sk_list.lock, then drops the lock before dispatching packets to callback handlers. Because AF_IUCV sockets rely on synchronous destruction rather than RCU deferred freeing, a parallel close() executing iucv_sock_kill() can free the socket in the window between the lock release and the handler invocation. When the handler subsequently accesses fields such as sk->sk_data_ready in afiucv_hs_callback_syn(), it operates on freed memory, potentially leading to kernel memory corruption or arbitrary code execution in kernel context.

Root Cause

The root cause is the absence of reference counting between socket discovery and handler dispatch. The lookup pattern releases the list lock without calling sock_hold() on the socket, and the AF_IUCV allocator does not defer freeing through RCU. The fix acquires a reference via sock_hold() while the socket remains on the list and releases it with sock_put() after the handler completes, closing the free window.

Attack Vector

Exploitation requires an adjacent network position capable of delivering IUCV packets to the target socket while a concurrent socket close is in progress. An attacker who can trigger the race deterministically may achieve kernel use-after-free primitives, which are commonly weaponized for privilege escalation on affected systems. IUCV is primarily used on IBM Z mainframes, limiting exposure to environments running that architecture with the protocol enabled.

No public exploit code is available. See the Kernel Git Commit Fix for the reference-count remediation.

Detection Methods for CVE-2026-68397

Indicators of Compromise

Unexpected kernel oops or panic messages referencing afiucv_hs_rcv, afiucv_hs_callback_syn, or sk_data_ready in dmesg and /var/log/kern.log.
KASAN or SLUB debug reports flagging use-after-free access on struct sock allocations from the AF_IUCV slab cache.
Kernel crashes on s390/s390x hosts correlated with IUCV socket close operations under network load.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface use-after-free access patterns in net/iucv/af_iucv.c during fuzzing or stress testing.
Monitor kernel logs for repeated soft lockups or general protection faults originating in the IUCV receive path.
Inventory hosts with the af_iucv module loaded (lsmod | grep iucv) to scope exposure across the fleet.

Monitoring Recommendations

Forward kernel logs from IBM Z Linux guests into a centralized logging platform and alert on crash signatures involving IUCV symbols.
Track kernel package versions and correlate against the stable commit hashes in the patch set (4dc0e63a, 5595ea59, 4fa34915, 1801cb20, c75a950e).
Baseline expected IUCV traffic volume between LPARs and flag anomalous connection churn that could indicate race-triggering activity.

How to Mitigate CVE-2026-68397

Immediate Actions Required

Apply the upstream stable kernel updates that include the sock_hold() / sock_put() fix in afiucv_hs_rcv().
Restrict IUCV network reachability to trusted LPARs and management interfaces on IBM Z systems.
If IUCV is not required, unload the af_iucv module and blacklist it to eliminate the attack surface.

Patch Information

The Linux kernel maintainers have merged the fix across multiple stable branches. Refer to the following commits for the patch content and backports: Kernel Git Commit Fix, Kernel Git Commit Patch, Kernel Git Commit Change, Kernel Git Commit Update, and Kernel Git Commit Improvement. Distribution-provided kernel updates should be installed once available.

Workarounds

Disable the AF_IUCV protocol on systems that do not use it by preventing the af_iucv module from loading via /etc/modprobe.d/.
Limit local user access on IBM Z Linux guests to reduce the ability to trigger concurrent socket close operations required for the race.
Segment IUCV traffic to trusted peers only, blocking untrusted sources from initiating IUCV connections.

bash

# Blacklist the af_iucv module until patched kernels are deployed
echo 'blacklist af_iucv' | sudo tee /etc/modprobe.d/disable-af_iucv.conf
sudo rmmod af_iucv 2>/dev/null || true
sudo update-initramfs -u