The fix addresses an issue in the Linux kernel’s IUCV socket implementation where the recvmsg() function would send a window update flag without verifying the transport type. On classic z/VM sockets this results in a NULL pointer dereference for the HiperSockets device, causing a spurious disconnect for an unprivileged process. Additionally, the code incorrectly allocates memory while holding a spin lock that is treated as atomic, allowing concurrent recvmsg() calls to manipulate a shared credit counter. This can lead to the counter becoming negative and the peer receiving credit twice, potentially allowing an attacker to affect the flow control state. The vulnerability is mitigated by the patch; before the fix, an attacker could exploit it to induce denial‑of‑service or disrupt kernel IUCV communication.

The vulnerability impacts Linux kernel implementations that provide the IUCV socket interface, specifically those versions that include the buggy recvmsg() logic. No specific kernel releases are listed in the data; the issue applies to any kernel that has not yet applied the kernel commit that introduces the fix. The affected systems are all machines running a Linux kernel that supports IUCV sockets.

The CVE does not provide a CVSS score, EPSS availability, or KEV status, so the formal risk level is unknown. Because the flaw is triggered by unprivileged processes calling recvmsg() on a classic z/VM socket, an attacker could readily trigger the fault without special access. The potential impact includes causing unnecessary socket disconnects and out‑of‑range credit counters, which could degrade system reliability or create a subtle denial‑of‑service vector. The lack of EPSS data means the current exploitation probability is unclear, but the absence of a KEV listing suggests no widespread, active exploits have been reported yet.