The Linux kernel net/iucv subsystem had a race condition vulnerability in the getsockopt handler for SO_MSGSIZE. Specifically, the code did not properly lock around the getsockopt call, allowing a race with recvmsg() and iucv_sock_close(). This race could cause a NULL pointer dereference when accessing iucv->hs_dev->mtu after hs_dev was set to NULL by iucv_sock_close(), resulting in a kernel crash (NULL pointer dereference oops). The fix involved mirroring the locking strategy used in iucv_sock_setsockopt() by wrapping the entire switch statement in lock_sock()/release_sock() calls and removing a now redundant SO_MSGLIMIT-only lock.

An attacker with access to AF_IUCV HIPER sockets could trigger a race condition causing a kernel NULL pointer dereference and crash, resulting in a denial of service. There is no indication of privilege escalation or code execution. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel source code to properly lock the getsockopt handler and prevent the race condition. Users should apply the official kernel updates that include this fix. Since this is not a cloud service, remediation depends on deploying patched kernel versions. Patch status is not explicitly confirmed in the provided data; check the vendor or kernel mailing list advisories for the exact fixed versions and update accordingly.