CVE-2026-81003

net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Published Sep 11, 2026 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: filter frames in afiucv_hs_rcv() by ingress device

afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte
name fields in the transport header alone. No check is made against the
net_device the frame arrived on.

This can cause a frame arriving on any netdev to be delivered to an AF_IUCV
socket. Three problems follow.

First, a frame arriving over HiperSockets can be delivered to a socket
bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL.
iucv_sock_bind() takes the classic path whenever the requested userid
matches iucv_userid, even on a guest that also has a HiperSockets device
carrying the same identifier. The child socket created by
afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and
transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.
The socket delivered to accept() is unusable.

Second, a frame arriving on one netdev can be delivered to a socket bound
to a different IQD device. Which can lead to
- Accept-queue exhaustion (DoS)
- Attacker-controlled peer identity in the child socket
- Data injection into existing sockets
- Fabric noise on the IQD fabric, where bogus replies are sent
- killing established connections

Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls
sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a
namespace can be delivered to an IUCV socket. So a process in an
unprivileged user and network namespace holding only the CAP_NET_RAW
capability valid within that namespace can send a raw ETH_P_AF_IUCV frame
on its own lo device and have it matched against init_net sockets.

Fix all three by skipping any socket whose hs_dev does not match the
ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress
dev is never NULL, so classic sockets are skipped automatically. An unbound
HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket
is only reachable from the exact IQD device it was bound to. Because hs_dev
is always a device in init_net (iucv_sock_bind() scans
for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress
device belongs to another namespace never matches any socket.

Note that AF_IUCV over HiperSockets provides no per-connection
authentication: no sequence numbers, no TLS, no nonce. The four name fields
identifying a connection are exchanged in plaintext on the shared
HiperSockets segment (VCHID). Any host on the same HiperSockets segment
could spoof any frame type against an existing connection. That is a
protocol-level property unchanged by this patch. The fix reduces the attack
surface to peers present on the same HiperSockets segment.

Analysis

Technical impact

The vulnerability arises from a missing verification step in the kernel’s IUCV receive routine, allowing any Ethernet frame received on AF_IUCV socket regardless of the socket’s bound interface. This flaw permits injection of frames that are delivered to sockets belonging to other network namespaces or hosts on the same HiperSockets segment. Consequently, attackers can exhaust the accept queue, cause DoS, spoof peer identity in newly created sockets, inject data into existing connections, and confuse the IQD fabric with bogus replies. The weakness is an improper authorization check when routing frames to sockets.

Affected Systems

All Linux kernel exists across every release vulnerable to the function implementation described. No specific version boundaries are provided in the advisory, so any kernel containing the unpatched code is vulnerable.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity, but the EPSS score of less than 1% suggests the exploitation probability is currently low. The flaw is not listed in the CISA KEV catalog. Exploitation requires the ability to send raw Ethernet frames, which is normally scoped to processes with the CAP_NET_RAW capability or processes running in a network namespace where CAP_NET_RAW is granted. Substantial impact is possible allowing The attack vector is local, leveraging privileged raw networking, and is likely to be feasible in environments where where IUCV/HiperSockets modules are active.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3881ac441f642d56503818123446f7298442236b`	affected	< 639828ad4d374056167391dbaffd13dd5e5e5ddb
`3881ac441f642d56503818123446f7298442236b`	affected	< 92e5c281f1caa287bb58292f2687c9e3ff3aa23e
`3881ac441f642d56503818123446f7298442236b`	affected	< 712330f8a4293cfd97b0d62b7c7dc01862a16b98
`3881ac441f642d56503818123446f7298442236b`	affected	< 0a5af67e7184c6a0e155c317840bd64b37177af4
`3881ac441f642d56503818123446f7298442236b`	affected	< dfac2936b83be00035ae176f8252e1c1e1de9207
`3881ac441f642d56503818123446f7298442236b`	affected	< 8e3763f1ccac3fc395f9af2b87114c023ced8a3f
`3881ac441f642d56503818123446f7298442236b`	affected	< a7f0130a091724e69827ab58e74777a88747e892
`3881ac441f642d56503818123446f7298442236b`	affected	< 80230a18c164a4b5bbc048fe2768b219ac17bc5a

Linux

affected

Version	Status	Constraints
`3.2`	affected	—
`0`	unaffected	< 3.2
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[3881ac441f642d56503818123446f7298442236b,dfac2936b83be00035ae176f8252e1c1e1de9207)`	affected	code_commit	—
`[3881ac441f642d56503818123446f7298442236b,8e3763f1ccac3fc395f9af2b87114c023ced8a3f)`	affected	code_commit	—
`[3881ac441f642d56503818123446f7298442236b,a7f0130a091724e69827ab58e74777a88747e892)`	affected	code_commit	—
`[3881ac441f642d56503818123446f7298442236b,80230a18c164a4b5bbc048fe2768b219ac17bc5a)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`3.2`	affected	generic	—
`[0,3.2)`	unaffected	generic	—
`[6.12.109,6.12.*]`	unaffected	generic	—
`[6.18.50,6.18.*]`	unaffected	generic	—
`[7.2.4,7.2.*]`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the frame‑filtering fix in afiucv_hs_rcv() to restrict socket selection to the ingress device.
Revoke CAP_NET_RAW from hosts that do not require raw frame capabilities, and consider raw‑frame privileges.
If IUCV or HiperSockets functionality is unnecessary for the host, disable or unload the iucv and hipersockets kernel modules to remove the attack surface.

Generated by OpenCVE AI on September 21, 2026 at 03:37 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-8961-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.309% probability within 30 days)

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0a5af67e7184c6a0e155c317840bd64b37177af4
https://git.kernel.org/stable/c/639828ad4d374056167391dbaffd13dd5e5e5ddb
https://git.kernel.org/stable/c/712330f8a4293cfd97b0d62b7c7dc01862a16b98
https://git.kernel.org/stable/c/80230a18c164a4b5bbc048fe2768b219ac17bc5a
https://git.kernel.org/stable/c/8e3763f1ccac3fc395f9af2b87114c023ced8a3f
https://git.kernel.org/stable/c/92e5c281f1caa287bb58292f2687c9e3ff3aa23e
https://git.kernel.org/stable/c/a7f0130a091724e69827ab58e74777a88747e892
https://git.kernel.org/stable/c/dfac2936b83be00035ae176f8252e1c1e1de9207

History

Sep 21, 2026 4:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-284

Sep 21, 2026 2:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-285

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0a5af67e7184c6a0e155c317840bd64b37177af4 https://git.kernel.org/stable/c/639828ad4d374056167391dbaffd13dd5e5e5ddb https://git.kernel.org/stable/c/712330f8a4293cfd97b0d62b7c7dc01862a16b98 https://git.kernel.org/stable/c/92e5c281f1caa287bb58292f2687c9e3ff3aa23e

Sep 13, 2026 9:15 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-285

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H'}`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is made against the net_device the frame arrived on. This can cause a frame arriving on any netdev to be delivered to an AF_IUCV socket. Three problems follow. First, a frame arriving over HiperSockets can be delivered to a socket bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL. iucv_sock_bind() takes the classic path whenever the requested userid matches iucv_userid, even on a guest that also has a HiperSockets device carrying the same identifier. The child socket created by afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV. The socket delivered to accept() is unusable. Second, a frame arriving on one netdev can be delivered to a socket bound to a different IQD device. Which can lead to - Accept-queue exhaustion (DoS) - Attacker-controlled peer identity in the child socket - Data injection into existing sockets - Fabric noise on the IQD fabric, where bogus replies are sent - killing established connections Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a namespace can be delivered to an IUCV socket. So a process in an unprivileged user and network namespace holding only the CAP_NET_RAW capability valid within that namespace can send a raw ETH_P_AF_IUCV frame on its own lo device and have it matched against init_net sockets. Fix all three by skipping any socket whose hs_dev does not match the ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress dev is never NULL, so classic sockets are skipped automatically. An unbound HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket is only reachable from the exact IQD device it was bound to. Because hs_dev is always a device in init_net (iucv_sock_bind() scans for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress device belongs to another namespace never matches any socket. Note that AF_IUCV over HiperSockets provides no per-connection authentication: no sequence numbers, no TLS, no nonce. The four name fields identifying a connection are exchanged in plaintext on the shared HiperSockets segment (VCHID). Any host on the same HiperSockets segment could spoof any frame type against an existing connection. That is a protocol-level property unchanged by this patch. The fix reduces the attack surface to peers present on the same HiperSockets segment.
Title		net/iucv: filter frames in afiucv_hs_rcv() by ingress device
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/80230a18c164a4b5bbc048fe2768b219ac17bc5a https://git.kernel.org/stable/c/8e3763f1ccac3fc395f9af2b87114c023ced8a3f https://git.kernel.org/stable/c/a7f0130a091724e69827ab58e74777a88747e892 https://git.kernel.org/stable/c/dfac2936b83be00035ae176f8252e1c1e1de9207