CVE-2026-81003

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/iucv: filter frames in afiucv_hs_rcv() by ingress device

afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte

name fields in the transport header alone. No check is made against the

net_device the frame arrived on.

This can cause a frame arriving on any netdev to be delivered to an AF_IUCV

socket. Three problems follow.

First, a frame arriving over HiperSockets can be delivered to a socket

bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL.

iucv_sock_bind() takes the classic path whenever the requested userid

matches iucv_userid, even on a guest that also has a HiperSockets device

carrying the same identifier. The child socket created by

afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and

transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.

The socket delivered to accept() is unusable.

Second, a frame arriving on one netdev can

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References