Junglewise Threat Intelligence

CVE-2026-31411: Linux Kernel NULL pointer dereference in ATM sigd_send

CVE-2026-31411 · Severity: medium · CVSS 5.5 · Published 2026-04-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's Asynchronous Transfer Mode (ATM) networking subsystem could allow a local attacker to crash the system. By acting as a malicious signaling daemon, a user can provide invalid memory addresses that the kernel will attempt to use, leading to a system failure. This issue primarily impacts system availability and could be used to disrupt operations on affected servers.

Technical details

A vulnerability exists in the ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) where the kernel reads a Virtual Channel Connection (VCC) pointer directly from a userspace-provided message structure without validation. An attacker with local access can call ioctl(ATMSIGD_CTRL) to become an ATM signaling daemon and then send a forged VCC pointer via sendmsg(). The kernel subsequently dereferences this arbitrary pointer, leading to a kernel panic or crash (CWE-476). The fix introduces find_get_vcc(), which validates the pointer against the vcc_hash table and manages reference counting via sock_hold/sock_put to ensure memory safety.

Affected products

  • Linux Linux Kernel versions from 2.6.12-rc2 up to 5.10.252; 5.11 to 5.15.202; 5.16 to 6.1.165; 6.2 to 6.6.128; 6.7 to 6.12.75; 6.13 to 6.18.14; 6.19 to 6.19.4

Timeline

  • 2026-04-08: disclosed: CVE-2026-31411 published
  • 2026-03-04: patched: Fix committed to stable branches

References