The Linux ATM networking stack allows an attacker to supply a forged vcc pointer via the sendmsg system call. The kernel reads this pointer from userspace, validates it only through a risky path, and dereferences it without proper checks, resulting in a kernel fault that can crash the system.

All Linux kernel versions prior to the commit that introduced find_get_vcc() (including 2.6.12 releases and up through 7.0 release candidates) are vulnerable. Any machine running a Linux kernel capable of creating an AF_ATMSVC socket is affected, as the flaw exists in the ATM stack shared by all kernels.

The CVSS score of 5.5 signifies moderate severity, and the EPSS score of <1% indicates a low probability of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to obtain root or privileged access to invoke the ATMSIGD_CTRL ioctl and act as the ATM signaling daemon. While the vector needs local privilege, the lack of input validation makes the crash easy to trigger once access is gained, creating a notable risk for high‑availability or critical systems.