PT-2026-90133
CVE-2026-81003
·
Published
2026-09-11
·
Updated
2026-11-12
Description by
CVSS 3.1
8.1
HighMetricsAV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
An issue exists in the
afiucv hs rcv() function where sockets are selected from the iucv sk list based solely on four 8-byte name fields in the transport header, without verifying the net device on which the frame arrived. This allows frames from any network device to be delivered to an AF IUCV socket, leading to several risks:- Frames arriving via HiperSockets may be delivered to sockets bound to the classic z/VM IUCV transport, resulting in unusable sockets.
- Frames from one network device can be delivered to a socket bound to a different IQD (Internal Queue Device) device, potentially causing accept-queue exhaustion (Denial of Service), data injection into existing sockets, attacker-controlled peer identity, and connection termination.
- Processes in unprivileged user and network namespaces with
CAP NET RAWcapabilities can send rawETH P AF IUCVframes via the loopback device to match sockets in the initial network namespace (init net).
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾