CVE-2026-23286: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23286 Overview

CVE-2026-23286 is a null pointer dereference vulnerability in the Linux kernel's ATM LAN Emulation (LEC) module. The flaw resides in the lec_arp_clear_vccs() function within the ATM subsystem. Syzkaller fuzzing identified the issue, which is reproducible using its automated reproducer. When multiple lec_arp_table entries share the same atm_vcc, closing the underlying Virtual Channel Connection (VCC) triggers repeated cleanup calls. The second iteration dereferences a NULL vpriv pointer freed during the first iteration, causing a kernel crash.

Critical Impact
Local unprivileged users can trigger a kernel null pointer dereference in the ATM LEC module, resulting in a denial of service through kernel panic.

Affected Products

Linux kernel versions containing the ATM LEC module prior to the upstream fix
Distributions shipping kernels with CONFIG_ATM_LANE enabled
Stable kernel branches awaiting backport from commits referenced in git.kernel.org

Discovery Timeline

2026-03-25 - CVE-2026-23286 published to NVD
2026-04-18 - Last updated in NVD database

Technical Details for CVE-2026-23286

Vulnerability Analysis

The vulnerability sits in the ATM LANE (LAN Emulation) module of the Linux kernel networking stack. The same atm_vcc structure can be referenced by multiple lec_arp_table entries through both entry->vcc and entry->recv_vcc fields. When lec_vcc_close() walks the ARP hashlists in priv->lec_arp_empty_ones and related tables, it invokes lec_arp_clear_vccs() once for each matched entry.

During the first iteration, lec_arp_clear_vccs() frees the vpriv structure attached via vcc->user_back and sets that pointer to NULL. On the next iteration covering another entry that shares the same VCC, the function retrieves vpriv again through the LEC_VCC_PRIV(vcc) macro and receives NULL. It then attempts vcc->pop = vpriv->old_pop, triggering the dereference.

Root Cause

The defect is a missing NULL check after VCC ownership transfer. The original code assumed a one-to-one mapping between ARP entries and VCC private data. Commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back") later added the entry->recv_vcc path using the same unsafe pattern, extending the affected code paths without addressing the shared-state assumption [CWE-476].

Attack Vector

An attacker with local access and the ability to interact with the ATM LANE module can craft a sequence of socket operations that produces multiple ARP table entries sharing one atm_vcc. Closing the VCC triggers the iteration pattern that frees vpriv once and then dereferences NULL on subsequent matches. Syzkaller produced a working reproducer, demonstrating that the path is reachable through standard system calls without elevated privileges on systems where ATM is enabled.

The upstream patch wraps the cleanup block, including vcc_release_async(), inside a vpriv NULL guard. When vpriv is NULL, the code skips the teardown and only clears the entry's vcc and recv_vcc pointers, preventing redundant callbacks on an already-closing socket.

Detection Methods for CVE-2026-23286

Indicators of Compromise

Kernel oops or panic logs referencing lec_arp_clear_vccs or lec_vcc_close in the call trace
BUG: kernel NULL pointer dereference entries in dmesg originating from the ATM subsystem
Unexpected system reboots on hosts where the atm and lec kernel modules are loaded

Detection Strategies

Audit loaded kernel modules with lsmod | grep -E 'atm|lec' to identify systems exposing the vulnerable code path
Monitor kernel ring buffer output for NULL pointer dereference traces tied to ATM LANE function symbols
Correlate process activity that opens AF_ATMSVC or AF_ATMPVC sockets with subsequent kernel faults

Monitoring Recommendations

Forward /var/log/kern.log and journalctl -k output to a centralized log platform for crash trace analysis
Enable kdump to capture kernel core dumps when faults occur in networking subsystems
Track unprivileged processes invoking ATM-related socket families, which is unusual on most production workloads

How to Mitigate CVE-2026-23286

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the kernel.org commits as soon as vendor backports are available
Blacklist the lec and atm modules on systems that do not require ATM LANE functionality
Restrict access to ATM socket families through seccomp profiles or container security policies

Patch Information

The fix is distributed across multiple stable branches via the following commits: 101bacb, 2d9f57e, 30c9744, 5f1cfea, 622062f, 7ea92ab, 8aff65a, and e966598. The patch adds a NULL check on vpriv and moves the cleanup block, including vcc_release_async(), inside the guarded branch.

Workarounds

Prevent automatic loading of the ATM LANE module by adding install lec /bin/true to /etc/modprobe.d/blacklist-atm.conf
Rebuild kernels without CONFIG_ATM_LANE where ATM emulation is not a functional requirement
Apply mandatory access control profiles that deny socket(AF_ATMSVC, ...) calls for non-root users

bash

# Configuration example
echo 'install lec /bin/true' | sudo tee /etc/modprobe.d/blacklist-atm.conf
echo 'install atm /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-atm.conf
sudo rmmod lec atm 2>/dev/null || true