{"id":"CVE-2026-99133","kind":"vulnerability","aliases":["CVE-2026-99133"],"related":[],"title":"Linux kernel: IUCV recvmsg window update crashes z/VM sockets","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/iucv: fix the recvmsg window update\n\niucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without\ntesting the transport, so on a classic z/VM socket iucv_send_ctrl() sizes\nthe skb through a NULL iucv->hs_dev. SO_MSGLIMIT accepts 1, so msglimit / 2\nis zero and one recvmsg() on its own socket is enough for an unprivileged\nprocess to take a spurious disconnect.\n\nIt also calls iucv_send_ctrl() under spin_lock_bh(&message_q.lock), which\nallocates GFP_KERNEL inside a section the code treats as atomic. Sending\noutside that lock lets two recvmsg() reach afiucv_hs_send() at once, where\nmsg_recv is sampled for the advertised window and subtracted after\ndev_queue_xmit() -- and sendmsg reaches that counter under lock_sock()\nwhile recvmsg holds no socket lock, so both can subtract the same value,\nthe counter goes negative and the credit reaches the peer twice.\n\nTest the transport, claim the credit with atomic_xchg() after the last\nerror exit and hand it back if the transmit fails, and send once the lock\nis dropped.","summary":"On classic z/VM AF_IUCV sockets, a recvmsg() window update dereferences a NULL HiperSockets device, and a race can double-send flow-control credit. An unprivileged local process can trigger a spurious disconnect, and the sources do not say whether memory corruption or code execution is possible.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ibm-z","iucv","linux-kernel","other","z-vm"],"not_affected_if":["no-af-iucv-sockets","non-s390"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:14+00:00","updated_at":"2026-10-28T11:36:14+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T11:36:14Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: IUCV recvmsg window update crashes z/VM sockets","impact":"low","summary":"On classic z/VM AF_IUCV sockets, a recvmsg() window update dereferences a NULL HiperSockets device, and a race can double-send flow-control credit. An unprivileged local process can trigger a spurious disconnect, and the sources do not say whether memory corruption or code execution is possible.","category":"other","nicknames":[],"who_cares":["linux-kernel","ibm-z","z-vm","iucv"],"confidence":0.5,"needs_auth":"no","worst_case":"Local process forces spurious disconnect; possible credit corruption","analyst_note":"Check the upstream kernel commit and NVD entry for the fixed kernel version and any severity score.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["non-s390","no-af-iucv-sockets"],"who_is_affected":"Only Linux systems running on IBM Z mainframes with z/VM IUCV sockets (AF_IUCV) are exposed; the advisory text describes the classic z/VM transport path, not HiperSockets. Hosts without IBM Z hardware or without AF_IUCV sockets in use can skip it. The sources do not give a fixed kernel version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000616,"input_tokens":3656,"output_tokens":500,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-99133':12A,15A '1':129C '2':132C 'accept':128C 'advertis':196C 'af':30B,100C 'afiucv':184C 'alloc':165C 'also':154C 'atom':175C,243C 'back':253C 'bh':162C 'call':155C 'claim':239C 'classic':28B,111C 'code':72B,172C 'control':51B 'corrupt':70B 'counter':208C,226C 'crash':7A 'credit':52B,231C,241C 'ctrl':116C,158C 'cve':10A,13A 'derefer':37B 'dev':125C,201C 'devic':41B 'disconnect':61B,152C 'doubl':47B 'double-send':46B 'drop':264C 'enough':143C 'error':248C 'execut':73B 'exit':249C 'fail':257C 'fix':87C 'flag':102C 'flow':50B 'flow-control':49B 'follow':81C 'gfp':166C 'goe':227C 'hand':251C 'hipersocket':40B,98C 'hipersockets-on':97C 'hold':214C 'hs':124C,185C 'ibm':17B 'ibm-z':16B 'insid':168C 'iucv':3A,19B,31B,92C,101C,114C,123C,156C 'kernel':2A,22B,79C,167C 'last':247C 'let':180C 'linux':1A,21B,78C 'linux-kernel':20B 'local':55B 'lock':161C,179C,210C,217C,262C 'memori':69B 'message_q.lock':163C 'msg':190C 'msglimit':127C,131C 'negat':228C 'net/iucv':86C 'null':39B,122C 'one':136C 'outsid':177C 'peer':234C 'possibl':75B 'process':56B,147C 'queue':202C 'race':44B 'reach':183C,206C,232C 'recv':191C 'recvmsg':4A,34B,89C,94C,137C,182C,213C 'resolv':85C 'sampl':193C 'say':67B 'section':170C 'send':48B,95C,115C,157C,176C,186C,259C 'sendmsg':205C 'size':117C 'skb':119C 'sock':93C,211C 'socket':9A,32B,113C,141C,216C 'sourc':64B 'spin':160C 'spurious':60B,151C 'subtract':199C,221C 'take':149C 'test':105C,236C 'transmit':256C 'transport':107C,238C 'treat':173C 'trigger':58B 'twice':235C 'two':181C 'unprivileg':54B,146C 'updat':6A,36B,91C 'valu':224C 'vm':26B 'vulner':82C 'whether':68B 'win':103C 'window':5A,35B,90C,197C 'without':104C 'xchg':244C 'xmit':203C 'z':18B,25B 'z-vm':24B 'z/vm':8A,29B,112C 'zero':134C","nicknames":[],"mitigations":[],"who_affected":"Only Linux systems running on IBM Z mainframes with z/VM IUCV sockets (AF_IUCV) are exposed; the advisory text describes the classic z/VM transport path, not HiperSockets. Hosts without IBM Z hardware or without AF_IUCV sockets in use can skip it. The sources do not give a fixed kernel version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99133","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99133","severity":null,"published_at":"2026-10-28T11:17:33+00:00","modified_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}