CVE-2026-64004 (GCVE-0-2026-64004)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:38
VLAI
Title
net/iucv: fix locking in .getsockopt
Summary
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed. Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 884eb247b74d86db97e3a37f0d6fc8e1e83590dd (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 45bb8de8c95d8899f4b8f61bd9bceb8132af73cb (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 1fc30bd4e55e2dd622d2d366cecd732c1841bbee (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < cd691beafea0dd779e69e81ccc26b0ab50efcb5e (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 6e792b8dd3002bbc4136745928a9605df1a72b8a (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 9817369243380e287ebe5525411557eaa3aa2a79 (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 69554adc7a6fa04ede3ad7512321d83748e3c920 (git)
Affected: 51363b8751a673a00ad48eea895266396d53fa52 , < 3589d20a666caf30ad100c960a2de7de390fce88 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "884eb247b74d86db97e3a37f0d6fc8e1e83590dd",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "45bb8de8c95d8899f4b8f61bd9bceb8132af73cb",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "1fc30bd4e55e2dd622d2d366cecd732c1841bbee",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "cd691beafea0dd779e69e81ccc26b0ab50efcb5e",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "6e792b8dd3002bbc4136745928a9605df1a72b8a",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "9817369243380e287ebe5525411557eaa3aa2a79",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "69554adc7a6fa04ede3ad7512321d83748e3c920",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            },
            {
              "lessThan": "3589d20a666caf30ad100c960a2de7de390fce88",
              "status": "affected",
              "version": "51363b8751a673a00ad48eea895266396d53fa52",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix locking in .getsockopt\n\nMirror iucv_sock_setsockopt() and wrap the whole switch in\nlock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock\nbecomes redundant and is removed.\n\nAny AF_IUCV HIPER user can potentially crash the kernel by racing\nrecvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences\niucv-\u003ehs_dev-\u003emtu after iucv_sock_close() (called from the racing\nrecvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference\noops."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached through the getsockopt(2) syscall on an AF_IUCV HIPER socket; the generic socket layer does not acquire the socket lock before calling iucv_sock_getsockopt(), so exploitation requires local access to the socket file descriptor.\nAC:L - The attacker controls both sides of the race by running concurrent getsockopt(SO_MSGSIZE) and recvmsg()/close() threads on the same socket, making the window reliably winnable without external timing luck.\nPR:L - The fix commit explicitly states any AF_IUCV HIPER user can trigger the crash, and iucv_sock_create imposes no capability or root requirement beyond creating and binding a HiperSockets AF_IUCV socket on s390.\nUI:N - Exploitation requires no action from any other user; the attacker races their own syscalls on a socket they control.\nS:U - The impact is a kernel oops or crash within the same kernel security boundary, with no cross-VM, cross-container, or IOMMU boundary crossing.\nC:H - The unlocked TOCTOU between the hs_dev NULL check and dereference races with dev_put() freeing the net_device, creating a use-after-free read whose mtu field is copied to userspace via copy_to_user.\nI:H - Use-after-free on a freed net_device structure in kernel heap memory is a memory corruption primitive that could be further leveraged for control-flow hijacking, and per kernel CVSS guidance UAF bugs warrant High integrity impact.\nA:H - Successful exploitation produces a NULL pointer dereference oops or kernel panic, causing complete loss of availability on the affected IBM Z LPAR or guest."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:04.824Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/884eb247b74d86db97e3a37f0d6fc8e1e83590dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/45bb8de8c95d8899f4b8f61bd9bceb8132af73cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fc30bd4e55e2dd622d2d366cecd732c1841bbee"
        },
        {
          "url": "https://git.kernel.org/stable/c/cd691beafea0dd779e69e81ccc26b0ab50efcb5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e792b8dd3002bbc4136745928a9605df1a72b8a"
        },
        {
          "url": "https://git.kernel.org/stable/c/9817369243380e287ebe5525411557eaa3aa2a79"
        },
        {
          "url": "https://git.kernel.org/stable/c/69554adc7a6fa04ede3ad7512321d83748e3c920"
        },
        {
          "url": "https://git.kernel.org/stable/c/3589d20a666caf30ad100c960a2de7de390fce88"
        }
      ],
      "title": "net/iucv: fix locking in .getsockopt",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64004",
    "datePublished": "2026-07-19T14:56:20.895Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:38:04.824Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64004",
      "date": "2026-10-02",
      "epss": "0.00129",
      "percentile": "0.0216"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/iucv/af_iucv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "884eb247b74d86db97e3a37f0d6fc8e1e83590dd",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "45bb8de8c95d8899f4b8f61bd9bceb8132af73cb",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fc30bd4e55e2dd622d2d366cecd732c1841bbee",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "cd691beafea0dd779e69e81ccc26b0ab50efcb5e",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6e792b8dd3002bbc4136745928a9605df1a72b8a",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "9817369243380e287ebe5525411557eaa3aa2a79",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "69554adc7a6fa04ede3ad7512321d83748e3c920",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3589d20a666caf30ad100c960a2de7de390fce88",
                    "status": "affected",
                    "version": "51363b8751a673a00ad48eea895266396d53fa52",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/iucv/af_iucv.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.4"
                  },
                  {
                    "lessThan": "3.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix locking in .getsockopt\n\nMirror iucv_sock_setsockopt() and wrap the whole switch in\nlock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock\nbecomes redundant and is removed.\n\nAny AF_IUCV HIPER user can potentially crash the kernel by racing\nrecvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences\niucv-\u003ehs_dev-\u003emtu after iucv_sock_close() (called from the racing\nrecvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference\noops."
          }
        ],
        "id": "CVE-2026-64004",
        "lastModified": "2026-07-30T14:51:11.223",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:40.043",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1fc30bd4e55e2dd622d2d366cecd732c1841bbee"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3589d20a666caf30ad100c960a2de7de390fce88"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/45bb8de8c95d8899f4b8f61bd9bceb8132af73cb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/69554adc7a6fa04ede3ad7512321d83748e3c920"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6e792b8dd3002bbc4136745928a9605df1a72b8a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/884eb247b74d86db97e3a37f0d6fc8e1e83590dd"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9817369243380e287ebe5525411557eaa3aa2a79"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/cd691beafea0dd779e69e81ccc26b0ab50efcb5e"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-21T15:08:18+00:00",
      "cve": "CVE-2026-64004",
      "id": "CVE-2026-64004",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/iucv: fix locking in .getsockopt",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64004.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:44:57Z",
      "cve": "CVE-2026-64004",
      "id": "CVE-2026-64004",
      "initial_release_date": "2026-07-21T13:01:45Z",
      "product_status:known_affected": "733",
      "product_status:recommended": "107",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64004",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64004.json",
      "version": "10"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.