{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.170-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.85-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.19.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  atm: lec: fix use-after-free in sock_def_readable()  A race condition exists between lec_atm_close() setting priv-\u003elecd to NULL and concurrent access to priv-\u003elecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue.  The root cause is that lec_atm_close() clears priv-\u003elecd without any synchronization, while callers dereference priv-\u003elecd without any protection against concurrent teardown.  Fix this by converting priv-\u003elecd to an RCU-protected pointer: - Mark priv-\u003elecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach()   for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference   the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and   lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(),   lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in   lec_atm_close() to ensure all readers have completed before   proceeding. This is safe since lec_atm_close() is called from   vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close()   since vcc_destroy_socket() already drains it after lec_atm_close()   returns.  v2: Switch from spinlock + sock_hold/put approach to RCU to properly     fix the race. The v1 spinlock approach had two issues pointed out     by Eric Dumazet:     1. priv-\u003elecd was still accessed directly after releasing the        lock instead of using a local copy.     2. The spinlock did not prevent packets being queued after        lec_atm_close() drains sk_receive_queue since timer and        workqueue paths bypass netif_stop_queue().  Note: Syzbot patch testing was attempted but the test VM terminated     unexpectedly with \"Connection to localhost closed by remote host\",     likely due to a QEMU AHCI emulation issue unrelated to this fix.     Compile testing with \"make W=1 net/atm/lec.o\" passes cleanly.",
  "id": "DEBIAN-CVE-2026-43050",
  "modified": "2026-09-14T16:47:29.983199004Z",
  "published": "2026-05-01T15:16:51.403Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-43050"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-43050"
  ]
}