https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:27:26 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68140 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: fix use-after-free of a severed iucv_path</p> <p>af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.</p> <p>Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: fix use-after-free of a severed iucv_path</p> <p>af_iucv queues not-yet-received message notifications on iucv-&gt;message_q, each holding a raw pointer to the connection&#39;s iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path.</p> <p>Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.</p> https://vulnerability.circl.lu/vuln/cve-2026-68140