Executive brief
A vulnerability in the Linux kernel's AF_IUCV networking protocol allows frames arriving on any network device to be delivered to unintended sockets. This can lead to socket hijacking, denial of service through connection exhaustion, and data injection attacks. The issue is particularly severe in containerized environments where unprivileged processes with CAP_NET_RAW capability can exploit network namespace boundaries to attack sockets in the host namespace.
Technical details
The vulnerability exists in the afiucv_hs_rcv() function, which selects AF_IUCV sockets by matching only four 8-byte name fields in the transport header without validating the ingress network device. This allows frames from any netdev to be matched against sockets bound to different devices or transports. Three attack vectors result: (1) frames on HiperSockets delivered to classic z/VM IUCV sockets (hs_dev == NULL), (2) frames on one IQD device reaching sockets bound to different devices, enabling accept-queue exhaustion, peer identity spoofing, and data injection, and (3) frames from unprivileged namespace processes reaching sockets in init_net. The fix adds ingress device validation: only sockets whose hs_dev matches the frame's ingress device are selected, automatically excluding classic and unbound sockets while enforcing device namespace boundaries.
Affected products
- Linux Linux Kernel Affected versions prior to patch (exact version range unspecified in advisory)
Timeline
- 2026-09-11: disclosed