CVE-2026-23286atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

Description

In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer. In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc). When the underlying VCC is closed, lec_vcc_close() iterates over all ARP entries and calls lec_arp_clear_vccs() for each matched entry. For example, when lec_vcc_close() iterates through the hlists in priv->lec_arp_empty_ones or other ARP tables: 1. In the first iteration, for the first matched ARP entry sharing the VCC, lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back) and sets vcc->user_back to NULL. 2. In the second iteration, for the next matched ARP entry sharing the same VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash. Fix this by adding a null check for vpriv before dereferencing it. If vpriv is already NULL, it means the VCC has been cleared by a previous call, so we can safely skip the cleanup and just clear the entry's vcc/recv_vcc pointers. The entire cleanup block (including vcc_release_async()) is placed inside the vpriv guard because a NULL vpriv indicates the VCC has already been fully released by a prior iteration — repeating the teardown would redundantly set flags and trigger callbacks on an already-closing socket. The Fixes tag points to the initial commit because the entry->vcc path has been vulnerable since the original code. The entry->recv_vcc path was later added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back") with the same pattern, and both paths are fixed here.

Timeline

Scores

EPSS (exploitation in 30 days)

0.13% · top 97% of all CVEs (13 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.5.

Affected products

• Linux · Linux

  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 30c9744a989feb22cfbb84170eb0e038a7a2c1da
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < e9665986eb127290ceb535bd5d04d7a84265d94f
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 622062f24644b4536d3f437e0cf7a8c4bb421665
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 2d9f57ea29a1f1772373b98a509b44d49fda609e
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 7ea92ab075d809ec8a96669a5ecf00f752057875
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 5f1cfea7921f5c126a441d973690eeba52677b64
  • affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – < 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb

• Linux · Linux

  • affected 2.6.12
  • unaffected < 2.6.12
  • unaffected 5.10.253 – ≤ 5.10.*
  • unaffected 5.15.203 – ≤ 5.15.*
  • unaffected 6.1.167 – ≤ 6.1.*
  • unaffected 6.6.130 – ≤ 6.6.*
  • unaffected 6.12.77 – ≤ 6.12.*
  • unaffected 6.18.17 – ≤ 6.18.*
  • unaffected 6.19.7 – ≤ 6.19.*
  • unaffected 7.0 – ≤ *

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2026-15212 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-23286](https://cveledger.app/badge/CVE-2026-23286.svg)](https://cveledger.app/cve/CVE-2026-23286)

Record last updated 5 Nov 2026, 21:33 UTC.