CVE-2026-31411: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31411 is a NULL pointer dereference vulnerability in the Linux kernel's ATM (Asynchronous Transfer Mode) networking subsystem, specifically in the sigd_send() function. The flaw allows a local attacker who has obtained ATM signaling daemon privileges to cause a kernel crash by supplying a forged virtual circuit connection (vcc) pointer via sendmsg(). It affects Linux kernel versions from 2.6.12.1 through multiple stable branches, with fixed versions including 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, and 6.19.4. Disclosed on April 8, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-476 (NULL Pointer Dereference). In the ATM send path (sendmsg → vcc_sendmsg → sigd_send), the kernel reads a vcc pointer directly from user-supplied message data (msg->vcc) without any validation. A process that has invoked ioctl(fd, ATMSIGD_CTRL) to become the ATM signaling daemon can craft a sendmsg() call embedding an arbitrary pointer value (e.g., 0xdeadbeef) at offset 4 of the message buffer, causing the kernel to dereference that address. The fix introduces a find_get_vcc() function that validates the pointer by searching through vcc_hash and acquires a reference via sock_hold() if found, preventing dereference of unvalidated addresses (GitHub Advisory).

Successful exploitation results in a kernel crash, causing a denial of service on the affected system. There is no confidentiality or integrity impact — the vulnerability is limited to availability. Only systems with the ATM networking subsystem enabled and where an attacker can obtain ATM signaling daemon privileges are at risk (GitHub Advisory).

1. Gain local access: Obtain a local user account on a Linux system with the ATM networking subsystem loaded (kernel module atm present).
2. Acquire signaling daemon privileges: Open an AF_ATMSVC socket and invoke ioctl(fd, ATMSIGD_CTRL) to register the process as the ATM signaling daemon — this requires the socket to be opened with appropriate permissions.
3. Craft malicious message: Prepare a sendmsg() payload buffer where bytes at offset 4 contain an arbitrary forged pointer value (e.g., 0xdeadbeef).
4. Trigger kernel dereference: Call sendmsg(fd, &msg, 0) — the kernel's sigd_send() reads the forged vcc pointer from the message and dereferences it without validation, causing a kernel panic and system crash (GitHub Advisory).

• Logs: Kernel oops or panic messages in /var/log/kern.log or dmesg output referencing sigd_send, vcc_sendmsg, or invalid memory access at addresses like 0xdeadbeef.
• Process: Unexpected processes holding AF_ATMSVC sockets or invoking ATMSIGD_CTRL ioctl, visible via ss -a or /proc/net/atm.
• System: Sudden system reboots or kernel crash dumps (kdump) on systems where ATM networking is not normally in use.

Apply the upstream Linux kernel patches available for all affected stable branches: 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, and 6.19.4. Distribution-specific updates have been issued by SUSE (SUSE-SU-2026:2068-1, SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1), Oracle Linux (ELSA-2026-50261), and Debian. As a workaround on systems that do not require ATM networking, restrict or blacklist the atm kernel module (echo 'blacklist atm' >> /etc/modprobe.d/blacklist.conf) and limit access to AF_ATMSVC socket creation to trusted users only (GitHub Advisory).