CVE-2026-23286: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23286 is a NULL pointer dereference vulnerability in the Linux kernel's ATM LANE (LAN Emulation) module, specifically within the lec_arp_clear_vccs() function. It was reported by syzkaller and disclosed on March 25, 2026, affecting Linux kernel versions from 2.6.12 through multiple stable branches up to 6.19.6. Fixed versions include 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, and 6.19.7. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) in lec_arp_clear_vccs() within the ATM LANE subsystem. When a VCC is closed, lec_vcc_close() iterates over all ARP table entries and calls lec_arp_clear_vccs() for each entry sharing the same atm_vcc. The first call frees the vpriv structure (vcc->user_back) and sets it to NULL; subsequent calls for other ARP entries sharing the same VCC then attempt to dereference the now-NULL vpriv via vcc->pop = vpriv->old_pop, triggering a kernel crash. The fix adds a NULL check for vpriv before dereferencing it, skipping the cleanup block if the VCC was already cleared by a prior iteration (Red Hat Bugzilla, git.kernel.org).

Successful exploitation causes a kernel NULL pointer dereference crash, resulting in a system-wide denial of service. The impact is limited to availability — there is no confidentiality or integrity impact. A local attacker with low privileges can trigger the crash by closing an ATM LANE VCC connection shared by multiple ARP entries, potentially disrupting all services running on the affected host (Red Hat Advisory).

No public proof-of-concept exploit or in-the-wild exploitation has been observed as of the time of disclosure. The vulnerability was originally discovered and reported via syzkaller, a kernel fuzzing tool, and a syzkaller reproducer exists but has not been publicly weaponized. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog (Red Hat Bugzilla, Feedly).

Update the Linux kernel to a patched stable version: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, or 6.19.7. Debian has issued security advisories (DSA-6238-1, DSA-6243-1, DLA-4561-1) addressing this issue. Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel 6.6.126.1-1 and later). If immediate patching is not possible, consider disabling or restricting access to ATM LANE functionality if it is not required in your environment (Red Hat Bugzilla, git.kernel.org, Microsoft).