---
id: CVE-2026-43050
title: 'atm: lec: fix use-after-free in sock_def_readable()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  atm: lec: fix use-after-free in sock_def_readable()

  A race condition exists between lec_atm_close() setting priv->lecd
  to NULL and concurrent access to priv->lecd in s…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3e8b25f32f2f35549d03d77da030a24a45bdef5b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    750a33f417f3d196b86375f8d9f8938bacf130fe
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    317843d5355062020649124eb4a0d7acbcc3f53e
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    b256d055da47258e63f8b40965f276c5f23d229a
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3989740fa4978e1d2d51ecc62be1b01093e104ad
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    abc10f85a3965ac14b9ed7ad3e67b35604a63aa3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5fbbb1ff936d7ff9528d929c1549977e8123d8a8
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    922814879542c2e397b0e9641fd36b8202a8e555
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T15:27:14.542294Z'
published: '2026-05-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T15:32:28.420Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43050'
references:
  - url: 'https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b'
  - url: 'https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe'
  - url: 'https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e'
  - url: 'https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a'
  - url: 'https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad'
  - url: 'https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3'
  - url: 'https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8'
  - url: 'https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555'
tags:
  - cve.org
epss: 0.00119
epssPercentile: 0.01754
ingestedAt: '2026-11-06T15:54:04.030Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

atm: lec: fix use-after-free in sock_def_readable()

A race condition exists between lec_atm_close() setting priv->lecd
to NULL and concurrent access to priv->lecd in send_to_lecd(),
lec_handle_bridge(), and lec_atm_send(). When the socket is freed
via RCU while another thread is still using it, a use-after-free
occurs in sock_def_readable() when accessing the socket's wait queue.

The root cause is that lec_atm_close() clears priv->lecd without
any synchronization, while callers dereference priv->lecd without
any protection against concurrent teardown.

Fix this by converting priv->lecd to an RCU-protected pointer:
- Mark priv->lecd as __rcu in lec.h
- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()
  for safe pointer assignment
- Use rcu_access_pointer() for NULL checks that do not dereference
  the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and
  lecd_attach()
- Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),
  lec_handle_bridge() and lec_atm_send() to safely access lecd
- Use rcu_assign_pointer() followed by synchronize_rcu() in
  lec_atm_close() to ensure all readers have completed before
  proceeding. This is safe since lec_atm_close() is called from
  vcc_release() which holds lock_sock(), a sleeping lock.
- Remove the manual sk_receive_queue drain from lec_atm_close()
  since vcc_destroy_socket() already drains it after lec_atm_close()
  returns.

v2: Switch from spinlock + sock_hold/put approach to RCU to properly
    fix the race. The v1 spinlock approach had two issues pointed out
    by Eric Dumazet:
    1. priv->lecd was still accessed directly after releasing the
       lock instead of using a local copy.
    2. The spinlock did not prevent packets being queued after
       lec_atm_close() drains sk_receive_queue since timer and
       workqueue paths bypass netif_stop_queue().

Note: Syzbot patch testing was attempted but the test VM terminated
    unexpectedly with "Connection to localhost closed by remote host",
    likely due to a QEMU AHCI emulation issue unrelated to this fix.
    Compile testing with "make W=1 net/atm/lec.o" passes cleanly.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3e8b25f32f2f35549d03d77da030a24a45bdef5b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 750a33f417f3d196b86375f8d9f8938bacf130fe`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 317843d5355062020649124eb4a0d7acbcc3f53e`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b256d055da47258e63f8b40965f276c5f23d229a`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3989740fa4978e1d2d51ecc62be1b01093e104ad`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < abc10f85a3965ac14b9ed7ad3e67b35604a63aa3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5fbbb1ff936d7ff9528d929c1549977e8123d8a8`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 922814879542c2e397b0e9641fd36b8202a8e555`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.