CVE-2026-43050 - Vulnerability Details

- atm: lec: fix use-after-free in sock_def_readable()

Description

In the Linux kernel, the following vulnerability has been resolved:

atm: lec: fix use-after-free in sock_def_readable()

A race condition exists between lec_atm_close() setting priv->lecd
to NULL and concurrent access to priv->lecd in send_to_lecd(),
lec_handle_bridge(), and lec_atm_send(). When the socket is freed
via RCU while another thread is still using it, a use-after-free
occurs in sock_def_readable() when accessing the socket's wait queue.

The root cause is that lec_atm_close() clears priv->lecd without
any synchronization, while callers dereference priv->lecd without
any protection against concurrent teardown.

Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()
for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference
the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and
lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),
lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in
lec_atm_close() to ensure all readers have completed before
proceeding. This is safe since lec_atm_close() is called from
vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close()
since vcc_destroy_socket() already drains it after lec_atm_close()
returns.

v2: Switch from spinlock + sock_hold/put approach to RCU to properly
fix the race. The v1 spinlock approach had two issues pointed out
by Eric Dumazet:
1. priv->lecd was still accessed directly after releasing the
lock instead of using a local copy.
2. The spinlock did not prevent packets being queued after
lec_atm_close() drains sk_receive_queue since timer and
workqueue paths bypass netif_stop_queue().

Note: Syzbot patch testing was attempted but the test VM terminated
unexpectedly with "Connection to localhost closed by remote host",
likely due to a QEMU AHCI emulation issue unrelated to this fix.
Compile testing with "make W=1 net/atm/lec.o" passes cleanly.

Published: 2026-05-01

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is a use‑after‑free condition in the Linux kernel’s ATM (lec) driver. When an ATM socket is freed while another thread attempts to read it, the socket’s wait queue is accessed after release, leading to corrupted memory pointers. This flaw, identified as CWE‑416 (Use After Free) and CWE‑825 (Memory Error), could allow an attacker to execute arbitrary code or crash the kernel, thereby disrupting service availability.

Affected Systems

All Linux systems running kernel versions that contain the vulnerable ATM implementation are affected. The specific version range is not listed in the advisory; however, the fix was merged in the kernel codebase in early 2026, so any kernel before that patch remains vulnerable. Linux distributors should verify that their kernel packages include the update.

Risk and Exploitability

The risk is moderate because exploitation requires timely interaction with the ATM interface while the socket is being torn down. The likely attack vector involves sending specially crafted ATM packets from a remote host or from a privileged local process. The EPSS score is below 1 %, the vulnerability is not listed in CISA’s KEV catalog, and the CVSS score of 7.0 indicates a high‑severity risk. Nonetheless, the potential for arbitrary code execution warrants preemptive action.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3e8b25f32f2f35549d03d77da030a24a45bdef5b
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 750a33f417f3d196b86375f8d9f8938bacf130fe
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 317843d5355062020649124eb4a0d7acbcc3f53e
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< b256d055da47258e63f8b40965f276c5f23d229a
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 3989740fa4978e1d2d51ecc62be1b01093e104ad
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< abc10f85a3965ac14b9ed7ad3e67b35604a63aa3
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 5fbbb1ff936d7ff9528d929c1549977e8123d8a8
`1da177e4c3f41524e886b7f1b8a0c1fc7321cac2`	affected	< 922814879542c2e397b0e9641fd36b8202a8e555

Linux

affected

Version	Status	Constraints
`2.6.12`	affected	—
`0`	unaffected	< 2.6.12
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.168`	unaffected	≤ 6.1.*
`6.6.134`	unaffected	≤ 6.6.*
`6.12.81`	unaffected	≤ 6.12.*
`6.18.22`	unaffected	≤ 6.18.*
`6.19.12`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:-::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc2::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc3::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc4::::::
	cpe:2.3:o:linux:linux_kernel:2.6.12:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3e8b25f32f2f35549d03d77da030a24a45bdef5b)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,750a33f417f3d196b86375f8d9f8938bacf130fe)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,317843d5355062020649124eb4a0d7acbcc3f53e)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b256d055da47258e63f8b40965f276c5f23d229a)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3989740fa4978e1d2d51ecc62be1b01093e104ad)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,abc10f85a3965ac14b9ed7ad3e67b35604a63aa3)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5fbbb1ff936d7ff9528d929c1549977e8123d8a8)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,922814879542c2e397b0e9641fd36b8202a8e555)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[5.10.253,5.11.0)`	unaffected	semver	—
`[5.15.203,5.16.0)`	unaffected	semver	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.134,6.7.0)`	unaffected	semver	—
`[6.12.81,6.13.0)`	unaffected	semver	—
`[6.18.22,6.19.0)`	unaffected	semver	—
`[6.19.12,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that contains the commits fixing the race condition (for example, upgrade to the latest stable release from 6.6 onward).
If an immediate kernel upgrade is not feasible, disable the ATM driver by unloading the module with `modprobe -r atm` or `modprobe -r lec`.
Configure firewalls or network policies to block ATM traffic from untrusted sources until the patch is applied.

Generated by OpenCVE AI on May 7, 2026 at 19:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e
https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad
https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b
https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8
https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe
https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555
https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3
https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a
https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43050-1cd2@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43050
https://www.cve.org/CVERecord?id=CVE-2026-43050

History

Thu, 07 May 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:2.6.12:-:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:::::: cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::

Sat, 02 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026050106-CVE-2026-43050-1cd2@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43050 https://www.cve.org/CVERecord?id=CVE-2026-43050
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 01 May 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.
Title		atm: lec: fix use-after-free in sock_def_readable()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8 https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555 https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3 https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-01T14:15:44.542Z

Updated: 2026-05-11T22:16:44.767Z

Reserved: 2026-05-01T14:12:55.979Z

Link: CVE-2026-43050

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-05-01T15:16:51.403

Modified: 2026-05-07T18:21:19.700

Link: CVE-2026-43050

Redhat

Severity : Moderate

Publid Date: 2026-05-01T00:00:00Z

Links: CVE-2026-43050 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-07T19:30:27Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object