CVE-2026-68141

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the afiucv hs callback syn() function. This occurs when the function attempts to allocate a child socket using GFP ATOMIC and the allocation fails, resulting in the nsk variable being NULL. The system then enters a connection-refused path—triggered by a failed listen state check, a full accept backlog, or the NULL nsk—and unconditionally calls the iucv sock kill() function. Because iucv sock kill() does not handle NULL socket pointers and immediately dereferences the socket via sock flag(sk, SOCK ZAPPED), the application crashes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.