CVE-2026-43050

Description

In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.

Overview

State

PUBLISHED

Assigner (CNA)

Linux

CVSS severity

high

CVSS score

—

CVSS vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Effective score

7.0 / 10 HIGH source: NVD

CWE(s)

—

Reserved

2026-05-01

Published

2026-05-01 16:15 UTC

Last updated

2026-05-12 00:16 UTC

Source

https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/43xxx/CVE-2026-43050.json

Linked Threat

CVE-2026-43050 — CVE-2026-43050

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-05-01 15:16:51 UTC

NVD last modified

2026-05-07 18:21:19 UTC

NVD CVSS v3.1

7.0 / 10 HIGH source: nvd@nist.gov

NVD CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability subscore

1.0 / 10

Impact subscore

5.9 / 10

EPSS score

0.0001 (probability of exploitation in next 30 days)

EPSS percentile

2.55% vs all CVEs — higher = more likely to be exploited, as of 2026-05-24

NVD-assigned CWE(s): CWE-416 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-26649

Assigner

Linux

Published

May 1, 2026, 2:15:44 PM

Updated

May 11, 2026, 10:16:44 PM

EUVD base score

0.0 / 10

EUVD-reported EPSS

0.0100

Vendors

Linux

Products

Linux (patch: 6.18.22)

Linux (patch: 0)

Linux (patch: 6.19.12)

Linux (patch: 6.1.168)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <b256d055da47258e63f8b40965f276c5f23d229a)

Linux (patch: 5.15.203)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <750a33f417f3d196b86375f8d9f8938bacf130fe)

Linux (patch: 6.6.134)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <922814879542c2e397b0e9641fd36b8202a8e555)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <abc10f85a3965ac14b9ed7ad3e67b35604a63aa3)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3e8b25f32f2f35549d03d77da030a24a45bdef5b)

Linux (patch: 5.10.253)

Linux (patch: 7.0)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <5fbbb1ff936d7ff9528d929c1549977e8123d8a8)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <3989740fa4978e1d2d51ecc62be1b01093e104ad)

Linux (2.6.12)

Linux (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <317843d5355062020649124eb4a0d7acbcc3f53e)

Linux (patch: 6.12.81)

ENISA description: In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.

Vendor references (8)

References embedded in the original CVE record by the assigning CNA.

• https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b
• https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe
• https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e
• https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a
• https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad
• https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3
• https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8
• https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555

Web references (14)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• http://cwe.mitre.org/data/definitions/416.html rapid7:cwe.mitre.org
• https://attackerkb.com/topics/CVE-2026-43050 rapid7:attackerkb.com
• https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26649 rapid7:euvd.enisa.europa.eu
• https://git.kernel.org/stable/c/317843d5355062020649124eb4a0d7acbcc3f53e tenable:git.kernel.org
• https://git.kernel.org/stable/c/3989740fa4978e1d2d51ecc62be1b01093e104ad tenable:git.kernel.org
• https://git.kernel.org/stable/c/3e8b25f32f2f35549d03d77da030a24a45bdef5b tenable:git.kernel.org
• https://git.kernel.org/stable/c/5fbbb1ff936d7ff9528d929c1549977e8123d8a8 tenable:git.kernel.org
• https://git.kernel.org/stable/c/750a33f417f3d196b86375f8d9f8938bacf130fe tenable:git.kernel.org
• https://git.kernel.org/stable/c/922814879542c2e397b0e9641fd36b8202a8e555 tenable:git.kernel.org
• https://git.kernel.org/stable/c/abc10f85a3965ac14b9ed7ad3e67b35604a63aa3 tenable:git.kernel.org
• https://git.kernel.org/stable/c/b256d055da47258e63f8b40965f276c5f23d229a tenable:git.kernel.org
• https://nvd.nist.gov/vuln/detail/CVE-2026-43050 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-43050 tenable:www.cve.org
• https://www.first.org/epss/ tenable:www.first.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• RHSB-2026-003 Networking subsystem Privilege Escalation - Linux Kernel ...
  web:access.redhat.com

  The mitigation methods below address both vulnerabilities that affect Red Hat products — CVE - 2026 -43284 (IPsec ESP) and CVE - 2026 -46300 (XFRM ESP-in-TCP). CVE - 2026 -43500 (rxrpc) does not affect Red Hat products and requires no mitigation .

  2026-05-23 20:23 UTC
• Microsoft and Adobe Patch Tuesday, April 2026 Security Update Review
  web:blog.qualys.com

  With Qualys Policy Audit's out-of-the-box mitigation or Compensatory Controls, which reduce the risk of a vulnerability being exploited because the remediation ( fix / patch ) cannot be done immediately, these security controls are not recommended by any industry standards, such as CIS and DISA-STIG.

  2026-05-23 20:23 UTC
• CISA Warns of Exploited Microsoft Defender 0-Day Flaws
  web:cyberpress.org

  The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two actively exploited Microsoft Defender vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, issuing an urgent remediation directive for federal agencies with a due date of June 3, 2026 .

  2026-05-23 20:23 UTC
• Patch Tuesday, May 2026 Edition - Krebs on Security
  web:krebsonsecurity.com

  Microsoft expects that exploitation is more likely. May's Patch Tuesday is a welcome respite from April, which saw Microsoft fix a near-record 167 security flaws.

  2026-05-23 20:23 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Security Update Guide - Microsoft Security Response Center

  2026-05-23 20:23 UTC
• CVE-2026-43500 and CVE-2026-43284 analysis
  web:socprime.com

  Explore Detections CVE - 2026 -43500 and CVE - 2026 -43284 Mitigation Practical CVE - 2026 -43500 mitigation starts with reducing available attack paths before a vendor patch is fully available across environments.

  2026-05-23 20:23 UTC
• Microsoft Patch Tuesday April 2026 Fixes 167 Bugs
  web:thecyberexpress.com

  Microsoft Patch Tuesday: Zero-Day Vulnerabilities in Focus A major focus of this Patch Tuesday April 2026 cycle is the remediation of two zero-day vulnerabilities. One of the most concerning issues is an actively exploited spoofing vulnerability in Microsoft SharePoint Server.

  2026-05-23 20:23 UTC
• April 2026 Patch Tuesday: Updates and Analysis | CrowdStrike
  web:www.crowdstrike.com

  Microsoft's April 2026 Patch Tuesday addresses 164 CVEs , featuring 8 Critical vulnerabilities, one exploited zero-day, and one disclosed zero-day.

  2026-05-23 20:23 UTC
• Oracle Critical Patch Update Advisory - April 2026
  web:www.oracle.com

  This Critical Patch Update contains 481 new security patches across the product families listed below. Please note that an MOS note summarizing the content of this Critical Patch Update and other Oracle Software Security Assurance activities is located at April 2026 Critical Patch Update: Executive Summary and Analysis.

  2026-05-23 20:23 UTC
• Patch Tuesday May 2026: Security Updates & CVE Analysis
  web:zecurit.com

  Get the complete breakdown of Microsoft's May 2026 Patch Tuesday. We analyze the latest security updates and all critical CVEs .

  2026-05-23 20:23 UTC
• Security Advisory Bulletin 064 | Ubiquiti Community
  web:community.ui.com

  Published: May 21, 2026 Updated: May 22, 2026 Version: 1.1 Revision: 1.1 Summary 1 of 5 A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection. Affected Products: UniFi OS Server (Version 5.0.6 and earlier) Mitigation : Update your UniFi OS Server to Version 5.0.8 or later ...

  2026-05-26 02:45 UTC
• Security Update Guide - Microsoft
  web:portal.msrc.microsoft.com

  The Security Update Guide provides information on the latest Microsoft security updates, helping users understand and address potential vulnerabilities effectively.

  2026-05-26 02:45 UTC
• Landing Page | ServiceNow Common Vulnerabilities & Exposures (CVE ...
  web:support.servicenow.com

  Overview The advisories below document publicly disclosed Common Vulnerabilities and Exposures ( CVEs ) in the Now Platform by ServiceNow. Because ServiceNow uses various methods to communicate vulnerability information, patches, and other fixes, customers should review family, security patch , and hotfix release notes, which are available at https://docs.servicenow.com, for a complete list of ...

  2026-05-26 02:45 UTC
• Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days
  web:www.bleepingcomputer.com

  Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

  2026-05-26 02:45 UTC
• Microsoft Issues Massive Windows Patch for 160+ Bugs ... - TechRepublic
  web:www.techrepublic.com

  Microsoft's April 2026 Patch Tuesday fixes 165 vulnerabilities, including two zero-days, in one of the company's largest monthly security updates.

  2026-05-26 02:45 UTC

Only Available for Registered Users. Sign in to view.