CVE-2026-43050

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> atm: lec: fix use-after-free in sock_def_readable()<br /> <br /> A race condition exists between lec_atm_close() setting priv-&gt;lecd<br /> to NULL and concurrent access to priv-&gt;lecd in send_to_lecd(),<br /> lec_handle_bridge(), and lec_atm_send(). When the socket is freed<br /> via RCU while another thread is still using it, a use-after-free<br /> occurs in sock_def_readable() when accessing the socket&amp;#39;s wait queue.<br /> <br /> The root cause is that lec_atm_close() clears priv-&gt;lecd without<br /> any synchronization, while callers dereference priv-&gt;lecd without<br /> any protection against concurrent teardown.<br /> <br /> Fix this by converting priv-&gt;lecd to an RCU-protected pointer:<br /> - Mark priv-&gt;lecd as __rcu in lec.h<br /> - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()<br /> for safe pointer assignment<br /> - Use rcu_access_pointer() for NULL checks that do not dereference<br /> the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and<br /> lecd_attach()<br /> - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),<br /> lec_handle_bridge() and lec_atm_send() to safely access lecd<br /> - Use rcu_assign_pointer() followed by synchronize_rcu() in<br /> lec_atm_close() to ensure all readers have completed before<br /> proceeding. This is safe since lec_atm_close() is called from<br /> vcc_release() which holds lock_sock(), a sleeping lock.<br /> - Remove the manual sk_receive_queue drain from lec_atm_close()<br /> since vcc_destroy_socket() already drains it after lec_atm_close()<br /> returns.<br /> <br /> v2: Switch from spinlock + sock_hold/put approach to RCU to properly<br /> fix the race. The v1 spinlock approach had two issues pointed out<br /> by Eric Dumazet:<br /> 1. priv-&gt;lecd was still accessed directly after releasing the<br /> lock instead of using a local copy.<br /> 2. The spinlock did not prevent packets being queued after<br /> lec_atm_close() drains sk_receive_queue since timer and<br /> workqueue paths bypass netif_stop_queue().<br /> <br /> Note: Syzbot patch testing was attempted but the test VM terminated<br /> unexpectedly with "Connection to localhost closed by remote host",<br /> likely due to a QEMU AHCI emulation issue unrelated to this fix.<br /> Compile testing with "make W=1 net/atm/lec.o" passes cleanly.