CVE-2026-74689: Linux Kernel ATM Buffer Overflow Vulnerability

CVE-2026-74689 Overview

CVE-2026-74689 is a slab-out-of-bounds read vulnerability in the Linux kernel's ATM (Asynchronous Transfer Mode) networking subsystem. The flaw resides in the vcc_setsockopt() function in net/atm/, where an ineffective option length check allowed callers to bypass size validation before invoking copy_from_sockptr(). A local user with the ability to open ATM sockets can trigger a kernel memory read beyond an allocated slab object, leading to information disclosure or kernel instability.

Critical Impact
Local attackers can trigger a KASAN-detected out-of-bounds read in kernel memory through crafted setsockopt() calls on ATM sockets, potentially disclosing kernel data or crashing the system.

Affected Products

Linux kernel — ATM networking subsystem (net/atm/common.c)
Stable kernel branches receiving backported fixes across commits 2c5988c7349c, 35f258fee9ed, 6eb6af887109, 9f77c1ab3821, b3bcd5d65ac0, and d0c80dbb9704
Linux distributions shipping vulnerable kernel builds with the ATM subsystem enabled

Discovery Timeline

2026-08-22 - CVE-2026-74689 published to the National Vulnerability Database
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74689

Vulnerability Analysis

The vulnerability affects vcc_setsockopt(), the setsockopt handler for ATM virtual channel connection sockets. The function guarded its option length validation behind a compound condition:

if (__SO_LEVEL_MATCH(optname, level) && optlen != __SO_SIZE(optname))
    return -EINVAL;

Because of short-circuit evaluation, the length check runs only when __SO_LEVEL_MATCH(optname, level) returns true. A caller passing a mismatched level argument skips the optlen validation entirely. Execution then reaches the switch(optname) block, which calls copy_from_sockptr() with the size of the expected option structure regardless of the attacker-supplied optlen.

A second exploitation path involves cgroup BPF setsockopt filters. Even when level matches, a BPF program can shrink optlen between the initial check and the copy. Because copy_from_sockptr() on kernel pointers reduces to memcpy(), the copy reads past the end of the user-supplied buffer's backing allocation, producing a slab-out-of-bounds read detectable by KASAN.

Root Cause

The root cause is improper input validation combined with a Time-of-Check to Time-of-Use (TOCTOU) window. The optlen guard is bypassable through logical short-circuiting and mutable through BPF hooks. A secondary defect: the local value variable was typed as unsigned long, which mismatches the sizeof(int) ABI encoding of SO_SETCLP on 64-bit systems.

Attack Vector

A local attacker opens an ATM socket via socket(AF_ATMPVC, ...) or socket(AF_ATMSVC, ...) and invokes setsockopt() with either a mismatched level value or a legitimate call whose optlen is subsequently shortened by an attached cgroup BPF filter. The resulting out-of-bounds read pulls adjacent slab memory into kernel processing, which can leak sensitive data through downstream behavior or induce a kernel panic when KASAN or hardened allocators are active.

No public proof-of-concept exploit is currently associated with this CVE, and it is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the upstream fix commits for technical details on the corrected validation logic.

Detection Methods for CVE-2026-74689

Indicators of Compromise

KASAN reports referencing slab-out-of-bounds reads originating in vcc_setsockopt or copy_from_sockptr call frames
Unexpected kernel oops or panic entries in dmesg tied to the net/atm subsystem
Unprivileged processes issuing setsockopt() on AF_ATMPVC or AF_ATMSVC sockets, particularly with unusual level values or attached BPF cgroup filters

Detection Strategies

Enable CONFIG_KASAN on test and staging kernels to surface out-of-bounds reads in vcc_setsockopt() during fuzzing or regression testing
Audit installed kernel versions against the fix commits (2c5988c7349c, 35f258fee9ed, 6eb6af887109, 9f77c1ab3821, b3bcd5d65ac0, d0c80dbb9704) to identify unpatched hosts
Monitor auditd or eBPF telemetry for socket creation with AF_ATMPVC / AF_ATMSVC families, which are rare in most production workloads

Monitoring Recommendations

Forward kernel ring buffer messages and KASAN traces to a centralized logging pipeline for correlation across fleet endpoints
Track setsockopt syscall usage on ATM sockets together with cgroup BPF attachments that can mutate optlen
Alert on kernel crash signatures involving the net/atm subsystem or on repeated EINVAL returns from ATM socket calls preceding a crash

How to Mitigate CVE-2026-74689

Immediate Actions Required

Apply the upstream kernel fixes that replace copy_from_sockptr() with copy_safe_from_sockptr() in vcc_setsockopt() and correct the value variable type to int
Update to a distribution kernel that includes one of the referenced stable commits and reboot affected hosts
If ATM networking is not required, disable or blacklist the atm kernel modules to eliminate the attack surface

Patch Information

The fix is available in mainline and stable Linux kernels via commits 2c5988c7349c, 35f258fee9ed, 6eb6af887109, 9f77c1ab3821, b3bcd5d65ac0, and d0c80dbb9704. The patches route option copying through copy_safe_from_sockptr(), which unconditionally validates that optlen meets the expected structure size before performing the copy.

Workarounds

Blacklist ATM modules with an entry such as blacklist atm in /etc/modprobe.d/ on systems that do not require ATM networking
Restrict creation of AF_ATMPVC and AF_ATMSVC sockets using seccomp filters or SELinux/AppArmor policies for untrusted workloads
Constrain unprivileged users' ability to attach cgroup BPF programs by tightening CAP_BPF and CAP_NET_ADMIN assignments

bash

# Configuration example: disable the ATM subsystem on systems that do not need it
echo 'blacklist atm' | sudo tee /etc/modprobe.d/disable-atm.conf
echo 'install atm /bin/true' | sudo tee -a /etc/modprobe.d/disable-atm.conf
sudo update-initramfs -u
# Verify the module is not loaded after reboot
lsmod | grep -E '^atm'