Re: [PATCH net] net/iucv: fix use-after-free of a severed iucv_path

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@xxxxxxxxxx>:

On Tue, 07 Jul 2026 02:00:54 -0500 you wrote:
> From: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> 
> af_iucv queues not-yet-received message notifications on iucv->message_q,
> each holding a raw pointer to the connection's iucv_path.  When the peer
> severs the connection, iucv_sever_path() frees that path with
> iucv_path_free() but leaves the notifications queued.  A later recvmsg()
> drains message_q via iucv_process_message_q() and hands the stale path to
> message_receive() -- a use-after-free of the freed iucv_path.
> 
> [...]

Here is the summary with links:
  - [net] net/iucv: fix use-after-free of a severed iucv_path
    https://git.kernel.org/netdev/net/c/be7cc4656eb1

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html