CVE-2026-23286

A flaw was found in the Linux kernel's ATM LANE (LAN Emulation) module. When an Asynchronous Transfer Mode Virtual Channel Connection (atm_vcc) is shared across multiple entries, a vulnerability in the lec_arp_clear_vccs function can lead to a null-pointer dereference. This occurs when the function attempts to access a previously freed data structure, resulting in a system crash and a Denial of Service (DoS).

This flaw affects systems using ATM LANE (LAN Emulation over ATM), which is legacy networking technology rarely used in modern deployments. The NULL pointer dereference occurs when iterating over shared VCC entries during cleanup. While the impact is a kernel crash, ATM LANE is uncommon in current enterprise environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the lec module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.