CVE-2026-64004 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net/iucv: fix locking in .getsockopt
Mirror iucv_sock_setsockopt() and wrap the whole switch in lock_sock()/release_sock(). The pre-existing SO_MSGLIMIT-only lock becomes redundant and is removed.
Any AF_IUCV HIPER user can potentially crash the kernel by racing recvmsg() with getsockopt(SO_MSGSIZE): the SO_MSGSIZE arm dereferences iucv->hs_dev->mtu after iucv_sock_close() (called from the racing recvmsg()) has set hs_dev to NULL, producing a NULL pointer dereference oops.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides in the Linux kernel's iucv networking subsystem which handles IBM System z IUCV (Inter-User Communication Vehicle) protocol communications. The issue manifests as a race condition between concurrent operations involving socket option retrieval and message reception, specifically when multiple threads attempt to access shared kernel data structures simultaneously without proper synchronization mechanisms. The vulnerability affects systems utilizing the AF_IUCV address family for communication between mainframe applications.
The technical flaw stems from inadequate locking mechanisms within the iucv_sock_getsockopt() function implementation. Previously, only the SO_MSGLIMIT option was protected by socket locking while other options remained unprotected. When a user process executes recvmsg() concurrently with getsockopt(SO_MSGSIZE), the race condition occurs because the getsockopt call attempts to dereference iucv->hs_dev->mtu after iucv_sock_close() has already executed and set hs_dev to NULL. This creates a classic null pointer dereference scenario that results in kernel oops and system crash.
The operational impact of this vulnerability is significant as it allows any authenticated user with access to AF_IUCV HIPER communication channels to potentially cause complete system crashes through carefully timed concurrent operations. The race condition specifically targets the timing window between socket closure and subsequent socket option processing, making it particularly dangerous in multi-threaded environments where such concurrent access patterns are common. This vulnerability directly violates the principle of proper resource management and synchronization in kernel space operations.
The fix implemented addresses this by mirroring the locking pattern used in iucv_sock_setsockopt() and wrapping the entire switch statement in lock_sock()/release_sock() calls. This comprehensive approach ensures that all socket option operations maintain consistent locking behavior, eliminating the redundant partial lock that previously existed. The solution aligns with common security practices for kernel synchronization as outlined in the Linux kernel documentation and follows established patterns for preventing race conditions in concurrent systems. This remediation prevents unauthorized users from exploiting timing dependencies to crash the kernel through null pointer dereference attacks.
This vulnerability maps to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization and is related to ATT&CK technique T1499.001: Endpoint Denial of Service. The fix demonstrates proper adherence to kernel security best practices for resource management in multi-threaded environments, ensuring that shared data structures are properly protected during concurrent access scenarios.