Executive brief
A vulnerability in the Linux kernel's ATM (Asynchronous Transfer Mode) networking component could allow a local user to crash the system. The issue occurs when the system attempts to close certain network connections that are shared across multiple internal tables, leading to a system failure (kernel panic). This primarily impacts system availability and could be used to disrupt operations on affected servers.
Technical details
A NULL pointer dereference exists in the 'lec_arp_clear_vccs' function within the ATM LANE (LAN Emulation) module (net/atm/lec.c). The vulnerability is triggered because multiple 'lec_arp_table' entries can share the same 'atm_vcc' structure. When 'lec_vcc_close' is called, it iterates through ARP entries; the first iteration frees the 'vpriv' (vcc->user_back) and sets it to NULL, but subsequent iterations for the same VCC attempt to dereference this now-NULL pointer to access 'old_pop'. This can be exploited by a local user to cause a denial-of-service (kernel crash). The fix introduces a NULL check for 'vpriv' before dereferencing.
Affected products
- Linux Linux kernel 2.6.12-rc2 to 6.19.7
Timeline
- 2026-02-25: patched: Initial patch authored by Jiayuan Chen
- 2026-03-25: disclosed: CVE-2026-23286 published
References
- https://git.kernel.org/stable/c/101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb
- https://git.kernel.org/stable/c/2d9f57ea29a1f1772373b98a509b44d49fda609e
- https://git.kernel.org/stable/c/30c9744a989feb22cfbb84170eb0e038a7a2c1da
- https://git.kernel.org/stable/c/5f1cfea7921f5c126a441d973690eeba52677b64
- https://git.kernel.org/stable/c/622062f24644b4536d3f437e0cf7a8c4bb421665
- https://git.kernel.org/stable/c/7ea92ab075d809ec8a96669a5ecf00f752057875
- https://git.kernel.org/stable/c/8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e