CVE-2026-23286: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
atm: lec: fix null-ptr-deref in lecarpclearvccs
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In the Linux ATM LANE module, add a null check for vpriv in lec_arp_clear_vccs() before dereferencing it; when vpriv is NULL, skip the cleanup and clear the entry's vcc/recv_vcc pointers.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23286?
CVE-2026-23286 is classified as a medium severity vulnerability due to the potential for a null pointer dereference.
How do I fix CVE-2026-23286?
To fix CVE-2026-23286, you should upgrade to the latest version of the Linux kernel that includes the relevant patches.
Which versions of the Linux kernel are affected by CVE-2026-23286?
CVE-2026-23286 affects certain versions of the Linux kernel prior to the patch that resolves the null pointer dereference issue.
What kind of issue does CVE-2026-23286 represent?
CVE-2026-23286 represents a null pointer dereference vulnerability in the Linux kernel's ATM LEC subsystem.
Is CVE-2026-23286 a remote or local vulnerability?
CVE-2026-23286 is primarily a local vulnerability as it requires local access to exploit the null pointer dereference.