CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of message notifications in the IUCV (Inter-User Communication Vehicle) subsystem, specifically due to a use-after-free condition when a connection is severed. This flaw can lead to potential exploitation, allowing an attacker to access freed memory, which may result in arbitrary code execution or system instability. Organizations using Linux systems, particularly those leveraging IUCV for inter-process communication, should prioritize addressing this vulnerability to mitigate associated risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix use-after-free of a severed iucv_path af_iucv queues not-yet-received message notifications on iucv->message_q, each holding a raw pointer to the connection's iucv_path. When the peer severs the connection, iucv_sever_path() frees that path with iucv_path_free() but leaves the notifications queued. A later recvmsg() drains message_q via iucv_process_message_q() and hands the stale path to message_receive() -- a use-after-free of the freed iucv_path. Drop the queued notifications when the path is severed; once the path is gone they can no longer be received. This also frees the notifications leaked when a socket is closed with messages still queued.