CVE-2026-68140

This is a use-after-free in the Linux kernel's AF_IUCV subsystem, and the mechanism matters more than the CVSS score suggests. The AF_IUCV message notification queue holds raw pointers to iucv_path objects, but those objects' lifecycle is managed by a separate connection state machine. When iucv_sever_path() tears down path resources, it doesn't drain the pending notifications that still reference it — the two code paths operate on different contracts with no cross-boundary synchronization. That boundary is the vulnerability. The fix drops queued notifications when the path is severed, which resolves the immediate UAF. But this exposes an adjacent behavioral change: messages queued when a socket closes are now also freed. The original design appears to have treated the message queue as a persistent store rather than a transient pipeline — a design choice that created the conditions for both the UAF and the leak. Had the queue's lifecycle been explicitly bound to the path's lifecycle from the start, this class of bug would have been structurally harder to introduce. The CVSS 8.8 score is misleading. IUCV is IBM mainframe VM-to-VM communication — you cannot reach it from an external attacker. Exploitation requires code execution within a z/VM guest or LPAR already. That confined blast radius should inform prioritization: patch it, but understand the actual exploitability constraints are architectural, not just technical. The deeper issue is that this pattern — raw pointers in notification queues decoupled from the referenced object's lifecycle — has appeared repeatedly in AF_UNIX, io_uring, and eventpoll. The kernel's subsystem model makes ownership and lifetime semantics implicit rather than enforced, which structurally favors this failure mode. For IUCV specifically, the small user base (shops running z/VM or PR/SM) means fewer eyeballs, slower feedback loops, and a maintenance culture where 'if it works in production, don't touch it' becomes architectural doctrine. That same confinement also means remediation pipelines are slower — patches can take 18 months to propagate through enterprise change management in mainframe environments, extending the actual exposure window beyond what the score implies. Check whether your systems expose AF_IUCV interfaces and prioritize patching accordingly. More broadly, audit other AF_* socket families for decoupled notification queues and connection teardown — this is a structural pattern, not an isolated incident.

Reviewed through automated stages and approved by a human before publication.