Vulnerability-Lookup

EUVD-2026-367555

European Vulnerability Database identifier assigned by ENISA

Reserved

2026-10-02 08:36

Assigner

ENISA

Alias of

a CVE record, shown under related vulnerabilities. This identifier carries no description, severity or references of its own: they belong to that CVE.

JSON

To clipboard

{
  "assigner": "ENISA",
  "date_reserved": "2026-10-02T08:36:26.690087+00:00",
  "id": "EUVD-2026-367555"
}

CVE-2026-81003 (GCVE-0-2026-81003)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59

Title

net/iucv: filter frames in afiucv_hs_rcv() by ingress device

Summary

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucv_hs_rcv() by ingress device afiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte name fields in the transport header alone. No check is made against the net_device the frame arrived on. This can cause a frame arriving on any netdev to be delivered to an AF_IUCV socket. Three problems follow. First, a frame arriving over HiperSockets can be delivered to a socket bound to the classic z/VM IUCV transport, which has iucv->hs_dev == NULL. iucv_sock_bind() takes the classic path whenever the requested userid matches iucv_userid, even on a guest that also has a HiperSockets device carrying the same identifier. The child socket created by afiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and transport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV. The socket delivered to accept() is unusable. Second, a frame arriving on one netdev can be delivered to a socket bound to a different IQD device. Which can lead to - Accept-queue exhaustion (DoS) - Attacker-controlled peer identity in the child socket - Data injection into existing sockets - Fabric noise on the IQD fabric, where bogus replies are sent - killing established connections Third, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls sk_alloc(&init_net, ...). But even frames arriving on netdev devices in a namespace can be delivered to an IUCV socket. So a process in an unprivileged user and network namespace holding only the CAP_NET_RAW capability valid within that namespace can send a raw ETH_P_AF_IUCV frame on its own lo device and have it matched against init_net sockets. Fix all three by skipping any socket whose hs_dev does not match the ingress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress dev is never NULL, so classic sockets are skipped automatically. An unbound HIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket is only reachable from the exact IQD device it was bound to. Because hs_dev is always a device in init_net (iucv_sock_bind() scans for_each_netdev_rcu(&init_net, ...) exclusively), a frame whose ingress device belongs to another namespace never matches any socket. Note that AF_IUCV over HiperSockets provides no per-connection authentication: no sequence numbers, no TLS, no nonce. The four name fields identifying a connection are exchanged in plaintext on the shared HiperSockets segment (VCHID). Any host on the same HiperSockets segment could spoof any frame type against an existing connection. That is a protocol-level property unchanged by this patch. The fix reduces the attack surface to peers present on the same HiperSockets segment.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Assigner

Linux mitre root Scorecard

References

8 references

URL	Tags
https://git.kernel.org/stable/c/639828ad4d3740561…
https://git.kernel.org/stable/c/92e5c281f1caa287b…
https://git.kernel.org/stable/c/712330f8a4293cfd9…
https://git.kernel.org/stable/c/0a5af67e7184c6a0e…
https://git.kernel.org/stable/c/dfac2936b83be0003…
https://git.kernel.org/stable/c/8e3763f1ccac3fc39…
https://git.kernel.org/stable/c/a7f0130a091724e69…
https://git.kernel.org/stable/c/80230a18c164a4b5b…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 3881ac441f642d56503818123446f7298442236b , < 639828ad4d374056167391dbaffd13dd5e5e5ddb (git) Affected: 3881ac441f642d56503818123446f7298442236b , < 92e5c281f1caa287bb58292f2687c9e3ff3aa23e (git) Affected: 3881ac441f642d56503818123446f7298442236b , < 712330f8a4293cfd97b0d62b7c7dc01862a16b98 (git) Affected: 3881ac441f642d56503818123446f7298442236b , < 0a5af67e7184c6a0e155c317840bd64b37177af4 (git) Affected: 3881ac441f642d56503818123446f7298442236b , < dfac2936b83be00035ae176f8252e1c1e1de9207 (git) Affected: 3881ac441f642d56503818123446f7298442236b , < 8e3763f1ccac3fc395f9af2b87114c023ced8a3f (git) Affected: 3881ac441f642d56503818123446f7298442236b , < a7f0130a091724e69827ab58e74777a88747e892 (git) Affected: 3881ac441f642d56503818123446f7298442236b , < 80230a18c164a4b5bbc048fe2768b219ac17bc5a (git)
Linux	Linux	Affected: 3.2 Unaffected: 0 , < 3.2 (semver) Unaffected: 5.10.270 , ≤ 5.10.* (semver) Unaffected: 5.15.221 , ≤ 5.15.* (semver) Unaffected: 6.1.188 , ≤ 6.1.* (semver) Unaffected: 6.6.157 , ≤ 6.6.* (semver) Unaffected: 6.12.109 , ≤ 6.12.* (semver) Unaffected: 6.18.50 , ≤ 6.18.* (semver) Unaffected: 7.2.4 , ≤ 7.2.* (semver) Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "639828ad4d374056167391dbaffd13dd5e5e5ddb",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "92e5c281f1caa287bb58292f2687c9e3ff3aa23e",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "712330f8a4293cfd97b0d62b7c7dc01862a16b98",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "0a5af67e7184c6a0e155c317840bd64b37177af4",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "dfac2936b83be00035ae176f8252e1c1e1de9207",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "8e3763f1ccac3fc395f9af2b87114c023ced8a3f",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "a7f0130a091724e69827ab58e74777a88747e892",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            },
            {
              "lessThan": "80230a18c164a4b5bbc048fe2768b219ac17bc5a",
              "status": "affected",
              "version": "3881ac441f642d56503818123446f7298442236b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/iucv/af_iucv.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: filter frames in afiucv_hs_rcv() by ingress device\n\nafiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte\nname fields in the transport header alone. No check is made against the\nnet_device the frame arrived on.\n\nThis can cause a frame arriving on any netdev to be delivered to an AF_IUCV\nsocket. Three problems follow.\n\nFirst, a frame arriving over HiperSockets can be delivered to a socket\nbound to the classic z/VM IUCV transport, which has iucv-\u003ehs_dev == NULL.\niucv_sock_bind() takes the classic path whenever the requested userid\nmatches iucv_userid, even on a guest that also has a HiperSockets device\ncarrying the same identifier. The child socket created by\nafiucv_hs_callback_syn() for such a match inherits hs_dev = NULL and\ntransport = AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.\nThe socket delivered to accept() is unusable.\n\nSecond, a frame arriving on one netdev can be delivered to a socket bound\nto a different IQD device. Which can lead to\n- Accept-queue exhaustion (DoS)\n- Attacker-controlled peer identity in the child socket\n- Data injection into existing sockets\n- Fabric noise on the IQD fabric, where bogus replies are sent\n- killing established connections\n\nThird, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls\nsk_alloc(\u0026init_net, ...). But even frames arriving on netdev devices in a\nnamespace can be delivered to an IUCV socket. So a process in an\nunprivileged user and network namespace holding only the CAP_NET_RAW\ncapability valid within that namespace can send a raw ETH_P_AF_IUCV frame\non its own lo device and have it matched against init_net sockets.\n\nFix all three by skipping any socket whose hs_dev does not match the\ningress device. A classic z/VM IUCV socket has hs_dev == NULL; the ingress\ndev is never NULL, so classic sockets are skipped automatically. An unbound\nHIPER socket also has hs_dev == NULL and is skipped. A bound HIPER socket\nis only reachable from the exact IQD device it was bound to. Because hs_dev\nis always a device in init_net (iucv_sock_bind() scans\nfor_each_netdev_rcu(\u0026init_net, ...) exclusively), a frame whose ingress\ndevice belongs to another namespace never matches any socket.\n\nNote that AF_IUCV over HiperSockets provides no per-connection\nauthentication: no sequence numbers, no TLS, no nonce. The four name fields\nidentifying a connection are exchanged in plaintext on the shared\nHiperSockets segment (VCHID). Any host on the same HiperSockets segment\ncould spoof any frame type against an existing connection. That is a\nprotocol-level property unchanged by this patch. The fix reduces the attack\nsurface to peers present on the same HiperSockets segment."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:A - afiucv_hs_rcv() is registered via dev_add_pack() for ethertype ETH_P_AF_IUCV (0xFBFB) on every netdevice and matches sockets by name fields only, so crafted L2 frames from a peer LPAR/guest on the HiperSockets VCHID or a host on an attached Ethernet segment reach AF_IUCV sockets; these frames are not IP-routable.\nAC:L - The attacker fully controls the ETH_P_AF_IUCV frames and can set the plaintext dest/src name fields to match a listening or connected socket (names are exchanged in the clear on the fabric and IBM apps use well-known 8-byte names), so matching and delivery are reliable with no race.\nPR:N - afiucv_hs_rcv() runs from netif RX softirq with no authentication, capability, or credential check on the path, so an adjacent HiperSockets or Ethernet peer needs no account or privilege on the victim s390 system.\nUI:N - Exploitation requires only sending crafted frames; the packet handler runs unconditionally in softirq and needs no victim action such as opening a file or mounting a filesystem.\nS:U - Impact is unauthorized delivery into the victim kernel\u0027s AF_IUCV sockets within the same OS security authority; this is not a KVM/Xen guest-to-host escape or IOMMU/DMA boundary bypass.\nC:N - The flaw injects attacker-supplied frames into socket receive and control paths and does not provide a kernel memory read, out-of-bounds read, or use-after-free disclosure primitive.\nI:H - Because lookup ignores the ingress device, an attacker can inject arbitrary payload into connected AF_IUCV sockets, spoof the accepted peer identity on SYN, and forge FIN/WIN control frames, fully compromising the integrity of AF_IUCV communications.\nA:H - SYN floods exhaust the listen accept queue and forged FIN/SYN|FIN frames tear down established connections, including classic z/VM IUCV sockets wrongly matched from any netdev, causing complete denial of AF_IUCV services."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:38.541Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/639828ad4d374056167391dbaffd13dd5e5e5ddb"
        },
        {
          "url": "https://git.kernel.org/stable/c/92e5c281f1caa287bb58292f2687c9e3ff3aa23e"
        },
        {
          "url": "https://git.kernel.org/stable/c/712330f8a4293cfd97b0d62b7c7dc01862a16b98"
        },
        {
          "url": "https://git.kernel.org/stable/c/0a5af67e7184c6a0e155c317840bd64b37177af4"
        },
        {
          "url": "https://git.kernel.org/stable/c/dfac2936b83be00035ae176f8252e1c1e1de9207"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e3763f1ccac3fc395f9af2b87114c023ced8a3f"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7f0130a091724e69827ab58e74777a88747e892"
        },
        {
          "url": "https://git.kernel.org/stable/c/80230a18c164a4b5bbc048fe2768b219ac17bc5a"
        }
      ],
      "title": "net/iucv: filter frames in afiucv_hs_rcv() by ingress device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-81003",
    "datePublished": "2026-09-11T19:42:56.172Z",
    "dateReserved": "2026-08-26T14:34:25.812Z",
    "dateUpdated": "2026-09-14T11:59:38.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

EUVD-2026-367555

CVE-2026-81003 (GCVE-0-2026-81003)

Tags

Sightings

Nomenclature

Related by attack behaviour