The Linux kernel vulnerability CVE-2026-81003 involves the afiucv_hs_rcv() function, which selects AF_IUCV sockets based solely on transport header name fields without verifying the ingress network device. This flaw allows frames from any netdev to be delivered to sockets bound to different devices or namespaces, causing accept-queue exhaustion (DoS), attacker-controlled peer identity, data injection, fabric noise, and killing established connections. Additionally, processes in unprivileged network namespaces with CAP_NET_RAW can send frames that match sockets in the init_net namespace. The patch fixes this by skipping sockets whose bound device (hs_dev) does not match the ingress device, effectively isolating sockets to their correct network devices and namespaces. The protocol itself lacks per-connection authentication, so some spoofing risks remain but the attack surface is reduced.

The vulnerability can lead to denial of service via accept-queue exhaustion, unauthorized data injection into existing sockets, attacker-controlled peer identity spoofing, disruption of IQD fabric communications, and unauthorized cross-namespace socket access. It affects the integrity and availability of AF_IUCV socket communications over HiperSockets in the Linux kernel. However, the protocol's inherent lack of per-connection authentication means some spoofing risks remain despite the fix.

A fix has been implemented in the Linux kernel to ensure afiucv_hs_rcv() filters frames by the ingress device, preventing delivery to sockets bound to different devices or namespaces. Users should apply the official kernel update that includes this patch. No additional mitigation is required as the patch addresses the vulnerability directly.