SB20261029178 - Race condition in Linux kernel iucv

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-99133)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to disrupt AF_IUCV flow control by causing receive credits to be advertised more than once.

The vulnerability exists due to a race condition in afiucv_hs_send() when concurrent socket operations read the receive-credit counter and subtract the sampled value after transmission without shared serialization. A local user can exercise concurrent recvmsg() and sendmsg() operations to subtract the same credit more than once, make the counter negative, and advertise duplicate credit to the peer.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/8f2efa742f4cfe7dd756154f8bc07350dbe3ec92
• https://git.kernel.org/stable/c/fa5acd038ea657ad5033713d6916214cbd349151
• https://git.kernel.org/stable/c/fe7393a627db2d093e8c0cae69d619b30fefae5f