CVE-2026-31411

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

Reproducer available at [1].

The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc

pointer from msg->vcc and uses it directly without any validation. This

pointer comes from userspace via sendmsg() and can be arbitrarily forged:

int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0);

ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon

struct msghdr msg = { .msg_iov = &iov, ... };

*(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer

sendmsg(fd, &msg, 0); // kernel dereferences 0xdeadbeef

In normal operation, the kernel sends the vcc pointer to the signaling

daemon via sigd_enq() when processing operations like connect(), bind(),

or listen(). The daemon is expected to return the same pointer when

responding. However, a malicious daemon can send arbitrary pointer values.

Fix this by introducing find_get_vcc() whi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References