Race Condition in Linux Kernel's ATM Module Affects Multithreaded Environment

CVE-2026-43050

What is CVE-2026-43050?

A race condition in the ATM module of the Linux kernel allows for a use-after-free vulnerability due to improper synchronization when accessing a socket. This occurs in functions like send_to_lecd() and lec_atm_send() when the socket is freed via RCU while still in use. The vulnerability arises because the setter function lec_atm_close() clears a pointer without adequate protection, leading to potential exploitation in multithreaded environments. The resolution involves transitioning to RCU-protected pointers to ensure safe access during concurrent execution, thus mitigating the risks associated with simultaneous socket operations.

References