CVE-2026-68140

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/iucv: fix use-after-free of a severed iucv_path<br /> <br /> af_iucv queues not-yet-received message notifications on iucv-&gt;message_q,<br /> each holding a raw pointer to the connection&amp;#39;s iucv_path. When the peer<br /> severs the connection, iucv_sever_path() frees that path with<br /> iucv_path_free() but leaves the notifications queued. A later recvmsg()<br /> drains message_q via iucv_process_message_q() and hands the stale path to<br /> message_receive() -- a use-after-free of the freed iucv_path.<br /> <br /> Drop the queued notifications when the path is severed; once the path is<br /> gone they can no longer be received. This also frees the notifications<br /> leaked when a socket is closed with messages still queued.