CVE-2026-68141

In the Linux kernel, the following vulnerability has been resolved:

net/afiucv: fix NULL deref in afiucvhscallbacksyn()

afiucvhscallbacksyn() allocates the child socket with GFPATOMIC. If the allocation fails, nsk is NULL.

The connection-refused path is entered when the listen state check fails, the accept backlog is full, or nsk is NULL. The code unconditionally calls iucvsockkill(nsk) in that path.

iucvsockkill() does not accept a NULL socket pointer and immediately dereferences sk via sockflag(sk, SOCKZAPPED). When nsk is NULL, calling iucvsockkill(nsk) results in a NULL pointer dereference.

Only call iucvsockkill() when a child socket was successfully allocated.