CVE-2026-23286 - Vulnerability Details

- atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

Description

In the Linux kernel, the following vulnerability has been resolved:

atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
This issue can be easily reproduced using the syzkaller reproducer.

In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by
multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).
When the underlying VCC is closed, lec_vcc_close() iterates over all
ARP entries and calls lec_arp_clear_vccs() for each matched entry.

For example, when lec_vcc_close() iterates through the hlists in
priv->lec_arp_empty_ones or other ARP tables:

1. In the first iteration, for the first matched ARP entry sharing the VCC,
lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)
and sets vcc->user_back to NULL.
2. In the second iteration, for the next matched ARP entry sharing the same
VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from
vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it
via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.

Fix this by adding a null check for vpriv before dereferencing
it. If vpriv is already NULL, it means the VCC has been cleared
by a previous call, so we can safely skip the cleanup and just
clear the entry's vcc/recv_vcc pointers.

The entire cleanup block (including vcc_release_async()) is placed inside
the vpriv guard because a NULL vpriv indicates the VCC has already been
fully released by a prior iteration — repeating the teardown would
redundantly set flags and trigger callbacks on an already-closing socket.

The Fixes tag points to the initial commit because the entry->vcc path has
been vulnerable since the original code. The entry->recv_vcc path was later
added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back")
with the same pattern, and both paths are fixed here.

Published: 2026-03-25

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A null pointer dereference in the Linux ATM LANE module’s lec_arp_clear_vccs function can cause an unprotected kernel crash. The flaw occurs when an ATM virtual circuit is closed and the cleanup routine is called repeatedly for entries that share the same circuit. Without a guard, the second call dereferences a NULL private structure, leading to a fatal fault. This is a classic null‑pointer exception (CWE‑476) that disrupts system stability and requires a reboot, but does not provide remote code execution or data exposure.

Affected Systems

All Linux kernel builds that include the ATM LANE (LAN Emulation) module are potentially affected, because the vulnerable code path resides in the kernel source. The advisory does not list specific version ranges; therefore any kernel containing the unpatched code is at risk. The fix is referenced by multiple commit identifiers in the provided patch URLs.

Risk and Exploitability

The vulnerability scoring indicates a moderate severity and a very low likelihood of widespread exploitation (<1 % EPSS). It is not featured in the CISA KEV catalog. Exploitation would require the attacker to interact with the ATM subsystem—likely through crafted ATM packets or by loading and manipulating the module from a privileged context—to trigger the fault. The effect is a local denial of service at the kernel level rather than escalation of privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 30c9744a989feb22cfbb84170eb0e038a7a2c1da
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< e9665986eb127290ceb535bd5d04d7a84265d94f
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 622062f24644b4536d3f437e0cf7a8c4bb421665
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 2d9f57ea29a1f1772373b98a509b44d49fda609e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 7ea92ab075d809ec8a96669a5ecf00f752057875
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5f1cfea7921f5c126a441d973690eeba52677b64
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.77`	unaffected	≤ 6.12.*
`6.18.17`	unaffected	≤ 6.18.*
`6.19.7`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e9665986eb127290ceb535bd5d04d7a84265d94f)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,622062f24644b4536d3f437e0cf7a8c4bb421665)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,2d9f57ea29a1f1772373b98a509b44d49fda609e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7ea92ab075d809ec8a96669a5ecf00f752057875)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5f1cfea7921f5c126a441d973690eeba52677b64)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.12`	affected	semver	—
`[0,2.6.12)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.77,6.13.0)`	unaffected	semver	—
`[6.18.17,6.19.0)`	unaffected	semver	—
`[6.19.7,6.20.0)`	unaffected	semver	—
`[7.0-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the patch commits 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb and related changes.
If an immediate kernel update is not available, unload or disable the ATM LANE module with modprobe -r atm to eliminate the vulnerable code path.
Verify that the module has been patched by checking the kernel configuration or inspecting the module version after applying the update.

Generated by OpenCVE AI on March 26, 2026 at 03:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00032.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb
https://git.kernel.org/stable/c/2d9f57ea29a1f1772373b98a509b44d49fda609e
https://git.kernel.org/stable/c/30c9744a989feb22cfbb84170eb0e038a7a2c1da
https://git.kernel.org/stable/c/5f1cfea7921f5c126a441d973690eeba52677b64
https://git.kernel.org/stable/c/622062f24644b4536d3f437e0cf7a8c4bb421665
https://git.kernel.org/stable/c/7ea92ab075d809ec8a96669a5ecf00f752057875
https://git.kernel.org/stable/c/8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e
https://git.kernel.org/stable/c/e9665986eb127290ceb535bd5d04d7a84265d94f
https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23286-8a7e@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23286
https://www.cve.org/CVERecord?id=CVE-2026-23286

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/30c9744a989feb22cfbb84170eb0e038a7a2c1da https://git.kernel.org/stable/c/8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026032524-CVE-2026-23286-8a7e@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23286 https://www.cve.org/CVERecord?id=CVE-2026-23286
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 25 Mar 2026 22:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer. In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc). When the underlying VCC is closed, lec_vcc_close() iterates over all ARP entries and calls lec_arp_clear_vccs() for each matched entry. For example, when lec_vcc_close() iterates through the hlists in priv->lec_arp_empty_ones or other ARP tables: 1. In the first iteration, for the first matched ARP entry sharing the VCC, lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back) and sets vcc->user_back to NULL. 2. In the second iteration, for the next matched ARP entry sharing the same VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash. Fix this by adding a null check for vpriv before dereferencing it. If vpriv is already NULL, it means the VCC has been cleared by a previous call, so we can safely skip the cleanup and just clear the entry's vcc/recv_vcc pointers. The entire cleanup block (including vcc_release_async()) is placed inside the vpriv guard because a NULL vpriv indicates the VCC has already been fully released by a prior iteration — repeating the teardown would redundantly set flags and trigger callbacks on an already-closing socket. The Fixes tag points to the initial commit because the entry->vcc path has been vulnerable since the original code. The entry->recv_vcc path was later added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back") with the same pattern, and both paths are fixed here.
Title		atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb https://git.kernel.org/stable/c/2d9f57ea29a1f1772373b98a509b44d49fda609e https://git.kernel.org/stable/c/5f1cfea7921f5c126a441d973690eeba52677b64 https://git.kernel.org/stable/c/622062f24644b4536d3f437e0cf7a8c4bb421665 https://git.kernel.org/stable/c/7ea92ab075d809ec8a96669a5ecf00f752057875 https://git.kernel.org/stable/c/e9665986eb127290ceb535bd5d04d7a84265d94f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:26:45.531Z

Updated: 2026-04-18T08:57:38.115Z

Reserved: 2026-01-13T15:37:45.992Z

Link: CVE-2026-23286

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-25T11:16:23.393

Modified: 2026-04-18T09:16:16.523

Link: CVE-2026-23286

Redhat

Severity : Moderate

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23286 - Bugzilla

OpenCVE Enrichment

Updated: 2026-03-26T12:17:31Z

Weaknesses

CWE-476

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object