CVE-2026-68397

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:AAttack vector, adjacent network

The vulnerable handler is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice, so any peer LPAR/guest on the same HiperSockets internal LAN or any host on an attached Ethernet segment can drive afiucv_hs_rcv() with crafted frames; the frames are raw L2 and cannot be routed across an IP hop, so the vector is adjacent rather than network.

AC:LAttack complexity, low

The attacker controls the packet side of the race outright (flooding 0xFBFB frames) and can drive the freeing side too, since SYN frames make a listener spawn and enqueue child sockets while FIN/SYN|FIN frames push sockets to IUCV_DISCONN and wake the application into close(), so the read_unlock()-to-handler window can be retried indefinitely until won.

PR:NPrivileges required, none

afiucv_hs_rcv() runs from the netif RX softirq and processes any matching frame with no authentication, credential check, or capability test anywhere on the path; the attacker needs no account or privilege on the target s390 system.

UI:NUser interaction, none

No victim action is required: the attacker's own frames both create the AF_IUCV child sockets and trigger the state changes that lead to their teardown, and the packet handler runs unconditionally in softirq context.

S:UScope, unchanged

The freed struct sock and the resulting corruption stay inside the kernel of the affected LPAR or z/VM guest; no hypervisor, IOMMU, or container boundary is crossed.

C:HConfidentiality impact, high

This is a use-after-free on a socket allocated from a generic kmalloc cache (iucv_proto is registered without its own slab), so an attacker who reclaims the object has the kernel read attacker-influenced or stale heap contents through sk fields, sk_filter()'s BPF program pointer, and the iucv backlog queues, yielding kernel memory disclosure.

I:HIntegrity impact, high

After the free the handlers perform indirect calls through the freed object (sk->sk_data_ready(), sk->sk_state_change(), sk_filter()) and writes into it (sk_state, atomic_sub on iucv->msg_sent, skb_queue_tail() list-pointer updates), giving control-flow hijack and write primitives once the slab object is reclaimed with attacker-controlled data.

A:HAvailability impact, high

Dereferencing the freed socket from softirq context reliably produces an oops or "Fatal exception in interrupt" panic, and the attacker can repeat the frame flood at will, causing complete loss of availability of the IBM Z LPAR or guest.