SB20261029176 - NULL pointer dereference in Linux kernel iucv

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-99133)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering an unintended AF_IUCV socket disconnect.

The vulnerability exists due to a NULL pointer dereference in iucv_send_ctrl() when iucv_sock_recvmsg() sends a HiperSockets-only window update over the classic z/VM transport. A local user can set SO_MSGLIMIT to 1 and invoke recvmsg() on their own socket to trigger the invalid access through iucv->hs_dev and an unintended disconnect.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8f2efa742f4cfe7dd756154f8bc07350dbe3ec92
• https://git.kernel.org/stable/c/fa5acd038ea657ad5033713d6916214cbd349151
• https://git.kernel.org/stable/c/fe7393a627db2d093e8c0cae69d619b30fefae5f