CVE-2026-43050

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

atm: lec: fix use-after-free in sock_def_readable()

A race condition exists between lec_atm_close() setting priv->lecd

to NULL and concurrent access to priv->lecd in send_to_lecd(),

lec_handle_bridge(), and lec_atm_send(). When the socket is freed

via RCU while another thread is still using it, a use-after-free

occurs in sock_def_readable() when accessing the socket's wait queue.

The root cause is that lec_atm_close() clears priv->lecd without

any synchronization, while callers dereference priv->lecd without

any protection against concurrent teardown.

Fix this by converting priv->lecd to an RCU-protected pointer:

- Mark priv->lecd as __rcu in lec.h

- Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()

for safe pointer assignment

- Use rcu_access_pointer() for NULL checks that do not dereference

the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and

lecd_attach()

- Use rcu_read_lock/rcu_dere

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References