{"id":"CVE-2026-68140","revision":"220741d61309445c9c47d2b74b947db6","records":[{"revision":"220741d61309445c9c47d2b74b947db6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-68140","aliases":[],"title":"net/iucv: fix use-after-free of a severed iucv_path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix use-after-free of a severed iucv_path\n\naf_iucv queues not-yet-received message notifications on iucv->message_q,\neach holding a raw pointer to the connection's iucv_path.  When the peer\nsevers the connection, iucv_sever_path() frees that path with\niucv_path_free() but leaves the notifications queued.  A later recvmsg()\ndrains message_q via iucv_process_message_q() and hands the stale path to\nmessage_receive() -- a use-after-free of the freed iucv_path.\n\nDrop the queued notifications when the path is severed; once the path is\ngone they can no longer be received.  This also frees the notifications\nleaked when a socket is closed with messages still queued.","state":0,"publishedAt":"2026-08-10T11:59:03.761+00:00","modifiedAt":"2026-10-19T20:58:53.121+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/iucv/af_iucv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"5f08c5e50bcb4680069bd3f9edd5728308816ded\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"c24faf11bd31bfe0500aca12cbdd5a573a954a5d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"99ddb33748698296a6f17b9b34aa3d16a406bb3c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"23658b350b4107e8292045c2044983fd426fa15d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"a5bbaddf69853117f28173c3f5c8fc14c6b2ec82\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"900cd6d8119b7f3ae5c4bf82f922ff5957df43db\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"f579582c03ed526281a8450159baf1d35099a85f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"f0703c80e5156406ad947cb67fe277725b48080f\",\n                            \"lessThan\": \"be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/iucv/af_iucv.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.24\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.24\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.148\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.101\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.42\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.6\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/5f08c5e50bcb4680069bd3f9edd5728308816ded","https://git.kernel.org/stable/c/c24faf11bd31bfe0500aca12cbdd5a573a954a5d","https://git.kernel.org/stable/c/99ddb33748698296a6f17b9b34aa3d16a406bb3c","https://git.kernel.org/stable/c/23658b350b4107e8292045c2044983fd426fa15d","https://git.kernel.org/stable/c/a5bbaddf69853117f28173c3f5c8fc14c6b2ec82","https://git.kernel.org/stable/c/900cd6d8119b7f3ae5c4bf82f922ff5957df43db","https://git.kernel.org/stable/c/f579582c03ed526281a8450159baf1d35099a85f","https://git.kernel.org/stable/c/be7cc4656eb1f54029610e82d1f0fdd3f9b5ec0a"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-68140","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-68140","identifiers":["CVE-2026-68140"]},"retained":false,"historicalAffected":[]}],"coverage":[]}