CVE-2026-53306: Linux Kernel hvc_iucv Off-by-One Denial of Service Vulnerability

Technical summary

The hvc_iucv driver maintains a static array, hvc_iucv_table[], sized to hold 8 entries (MAX_HVC_IUCV_LINES). The vulnerability arises from an off-by-one error in bounds validation. One code path (a) compares a user-supplied number against hvc_iucv_devices but fails to account for zero-based indexing, permitting access to hvc_iucv_table[8] when hvc_iucv_devices==8. In contrast, other code paths (b) correctly iterate using 'i < hvc_iucv_devices', confirming the inconsistency. The flaw is classified as CWE-193 (Off-by-one Error) and can be triggered by a local, unprivileged user with kernel module or sysfs interaction capabilities.

Business impact

This vulnerability can be exploited by local users to destabilize production systems running affected kernels. A successful exploit would trigger a kernel panic, resulting in immediate system downtime and potential data loss for in-flight transactions. Organizations running containerized workloads or multi-tenant environments face particular risk, as a single compromised container or unprivileged user could crash the shared host kernel. Recovery requires manual intervention and reboot, impacting service availability.

Affected systems

The Linux kernel is affected across all versions containing the vulnerable hvc_iucv driver code. Vulnerable systems typically include POWER architecture systems (s390/s390x) where IUCV (Inter-User Communication Vehicle) hypervisor consoles are in use. Systems that do not load or enable the hvc_iucv driver module are not affected. Embedded systems, cloud platforms, and virtualized environments using POWER-based infrastructure should verify their kernel versions and module configuration.

Exploitability

The vulnerability requires local access and can be triggered without elevated privileges, making it exploitable by any unprivileged user on the system. No network access or user interaction is required beyond the ability to interact with kernel module parameters or device configuration. The attack surface is relatively narrow, limited to systems with the hvc_iucv driver loaded and accessible. Exploitation is straightforward once access is gained, consisting of parameter manipulation or sysfs writes to exceed the device allocation boundary.

Remediation

The Linux kernel maintainers have resolved this issue by correcting the bounds-checking logic in the hvc_iucv driver to consistently validate the device counter against MAX_HVC_IUCV_LINES before array access. The fix ensures all code paths perform proper off-by-one boundary validation. Systems should apply the patched kernel version released after the vulnerability was disclosed. Verify against the Linux kernel security advisory and your distribution's patch bulletin for the specific fixed version applicable to your kernel branch.

Patch guidance

Apply the latest stable or long-term support kernel update from your Linux distribution that includes the hvc_iucv bounds-check fix. For distributions providing security updates (Red Hat, SUSE, Canonical, etc.), check the security advisory portal for your release. If using a custom or vendor-specific kernel, consult the source repository commit history referencing CVE-2026-53306 or the hvc_iucv off-by-one fix. Reboot is required after kernel installation. Prioritize patching for systems with hvc_iucv driver loaded, verifiable via 'lsmod | grep hvc_iucv'.

Detection guidance

Monitor system logs for kernel panic or oops messages referencing hvc_iucv or memory access violations at the boundary of array allocations. Kernel sanitizers (KASAN, UBSAN) configured in development or staging environments will detect this flaw. Review dmesg or journalctl output for out-of-bounds warnings. In production, alerting on unexpected kernel crashes or page faults may indicate exploitation attempts. Audit sysfs writes to hvc_iucv-related parameters on systems where this module is active.

Why prioritize this

Although rated MEDIUM severity due to local-only access requirements, this vulnerability warrants prompt remediation because it affects system availability with high impact (denial of service via kernel panic). Organizations running POWER-based infrastructure or systems where hvc_iucv is enabled should treat this as a moderate-priority patching target. The low barrier to exploitation and direct path to crash make it more urgent than its CVSS score alone might suggest.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects the local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), absence of user interaction (UI:N), and availability impact (A:H). The score appropriately captures that only local users with some privilege can trigger the flaw, but the impact—an uncontrolled kernel crash—is severe. No confidentiality or integrity compromise is possible, limiting the overall severity. For organizations with unprivileged user populations or shared systems, the practical risk may be elevated.

Frequently asked questions