---
id: CVE-2026-23286
title: 'atm: lec: fix null-ptr-deref in lec_arp_clear_vccs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

  syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
  This issue can be easily reproduced using the syzkaller…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    30c9744a989feb22cfbb84170eb0e038a7a2c1da
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    e9665986eb127290ceb535bd5d04d7a84265d94f
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    622062f24644b4536d3f437e0cf7a8c4bb421665
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    2d9f57ea29a1f1772373b98a509b44d49fda609e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    7ea92ab075d809ec8a96669a5ecf00f752057875
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5f1cfea7921f5c126a441d973690eeba52677b64
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:25:04.726747Z'
published: '2026-03-25'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:35.470Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23286'
references:
  - url: 'https://git.kernel.org/stable/c/8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e'
  - url: 'https://git.kernel.org/stable/c/30c9744a989feb22cfbb84170eb0e038a7a2c1da'
  - url: 'https://git.kernel.org/stable/c/e9665986eb127290ceb535bd5d04d7a84265d94f'
  - url: 'https://git.kernel.org/stable/c/622062f24644b4536d3f437e0cf7a8c4bb421665'
  - url: 'https://git.kernel.org/stable/c/2d9f57ea29a1f1772373b98a509b44d49fda609e'
  - url: 'https://git.kernel.org/stable/c/7ea92ab075d809ec8a96669a5ecf00f752057875'
  - url: 'https://git.kernel.org/stable/c/5f1cfea7921f5c126a441d973690eeba52677b64'
  - url: 'https://git.kernel.org/stable/c/101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb'
tags:
  - cve.org
epss: 0.0013
epssPercentile: 0.02647
ingestedAt: '2026-11-05T22:38:32.109Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

atm: lec: fix null-ptr-deref in lec_arp_clear_vccs

syzkaller reported a null-ptr-deref in lec_arp_clear_vccs().
This issue can be easily reproduced using the syzkaller reproducer.

In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by
multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc).
When the underlying VCC is closed, lec_vcc_close() iterates over all
ARP entries and calls lec_arp_clear_vccs() for each matched entry.

For example, when lec_vcc_close() iterates through the hlists in
priv->lec_arp_empty_ones or other ARP tables:

1. In the first iteration, for the first matched ARP entry sharing the VCC,
lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back)
and sets vcc->user_back to NULL.
2. In the second iteration, for the next matched ARP entry sharing the same
VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from
vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it
via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash.

Fix this by adding a null check for vpriv before dereferencing
it. If vpriv is already NULL, it means the VCC has been cleared
by a previous call, so we can safely skip the cleanup and just
clear the entry's vcc/recv_vcc pointers.

The entire cleanup block (including vcc_release_async()) is placed inside
the vpriv guard because a NULL vpriv indicates the VCC has already been
fully released by a prior iteration — repeating the teardown would
redundantly set flags and trigger callbacks on an already-closing socket.

The Fixes tag points to the initial commit because the entry->vcc path has
been vulnerable since the original code. The entry->recv_vcc path was later
added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back")
with the same pattern, and both paths are fixed here.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 8aff65a82b6389ec674d46e5b3d3ae6f07db5e3e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 30c9744a989feb22cfbb84170eb0e038a7a2c1da`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e9665986eb127290ceb535bd5d04d7a84265d94f`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 622062f24644b4536d3f437e0cf7a8c4bb421665`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2d9f57ea29a1f1772373b98a509b44d49fda609e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7ea92ab075d809ec8a96669a5ecf00f752057875`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5f1cfea7921f5c126a441d973690eeba52677b64`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 101bacb303e89dc2e0640ae6a5e0fb97c4eb45bb`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.