CVE-2026-81003High· 7.0▾ TwilightA flaw was found in the Linux kernel's AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The `afiucv_hs_rcv()` function, responsible for receiving frames, does not properly filter incoming frame…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
— → 8.1
none → high
0.2% → 0.5%
8.1 → 7
7 → 8.1
Last analysed / modified upstream
8.1 → 7
A flaw was found in the Linux kernel's AF_IUCV (Advanced Program-to-Program Communication over IUCV) network protocol implementation. The afiucv_hs_rcv() function, responsible for receiving frames, does not properly filter incoming frames based on the ingress network device. This oversight allows a local attacker with specific network capabilities or a host on the same HiperSockets segment to send specially crafted frames. Successful exploitation can lead to a Denial of Service (DoS) by exhausting the accept-queue, injecting data into existing sockets, and disrupting established connections.
kernel: net/iucv: filter frames in afiucv_hs_rcv() by ingress device — rated Important by Red Hat. Released 2026-09-11, updated 2026-10-26.
Affected:
Fixed:
No fix planned:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:83156 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:89083
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72072Medium· 4.1kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (CVE-2026-72072)
CVE-2023-54292Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_o…
CVE-2023-54156High· 7.8In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_s…
CVE-2023-53747High· 7.8In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port…
CVE-2026-72045High· 8.8In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF rvu_mbox_handler_lmtst_tbl_setup() uses req->base_pcifunc as a direct index into the LMT map table to re…
CVE-2026-68159Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE __decode_pg_temp() decodes an user-controlled length but only rejects values large enough to over…