CVE-2026-53306 Details
Description
In the Linux kernel, the following vulnerability has been resolved: tty: hvc_iucv: fix off-by-one in number of supported devices MAX_HVC_IUCV_LINES == HVC_ALLOC_TTY_ADAPTERS == 8. This is the number of entries in: static struct hvc_iucv_private *hvc_iucv_table[MAX_HVC_IUCV_LINES]; Sometimes hvc_iucv_table[] is limited by: (a) if (num > hvc_iucv_devices) // for error detection or (b) for (i = 0; i < hvc_iucv_devices; i++) // in 2 places (so these 2 don't agree; second one appears to be correct to me.) hvc_iucv_devices can be 0..8. This is a counter. (c) if (hvc_iucv_devices > MAX_HVC_IUCV_LINES) If hvc_iucv_devices == 8, (a) allows the code to access hvc_iucv_table[8]. Oops.
An off-by-one vulnerability has been identified in the Linux kernel's handling of hypervisor console support for the IUCV (Inter-User Communication Vehicle) on the S390 architecture. This vulnerability arises from an incorrect validation of the number of supported devices, allowing potential access beyond the intended limits. The issue is present in the stable Linux kernel versions prior to the fix, where the error in device count validation could lead to accessing an invalid entry in the device table.
Users can upgrade to the latest stable version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux kernel official website.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/11207e42a332eb8bbcb9fe74df9edd2a807c5607 | kernel.org | Patch |
| https://git.kernel.org/stable/c/3104a3f40feb107f77d7116ad9bf6c210ab7babf | kernel.org | Patch |
| https://git.kernel.org/stable/c/3d3b89e6ab93bdd0efd45828bda6b0e61cc46dff | kernel.org | Patch |
| https://git.kernel.org/stable/c/484357dff256c816d9466bda35eb765685e4dc86 | kernel.org | Patch |
| https://git.kernel.org/stable/c/a76511bc654819425d3b15e77b523d7f9d81f064 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f1dc8e72de9aabe5d96767a4e97219ac26b79fe5 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f2a880e802ad12d1e38039d1334fb1475d0f5241 | kernel.org | Patch |
| https://git.kernel.org/stable/c/fed8b8f33a46db0ee2efdb000f4f630c86ed8ca4 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-193 | Off-by-one Error | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 2.6.29, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.141 >= 6.7, < 6.12.91 >= 6.13, < 6.18.33 >= 6.19, < 7.0.10 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 6, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | New CVE Received | kernel.org |