Race condition in Linux kernel - CVE-2026-99133
Published: October 29, 2026
Vulnerability identifier: #VU158453
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99133
CWE-ID: CWE-362
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disrupt AF_IUCV flow control by causing receive credits to be advertised more than once.
The vulnerability exists due to a race condition in afiucv_hs_send() when concurrent socket operations read the receive-credit counter and subtract the sampled value after transmission without shared serialization. A local user can exercise concurrent recvmsg() and sendmsg() operations to subtract the same credit more than once, make the counter negative, and advertise duplicate credit to the peer.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99133
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2