CVE-2026-31411

The Linux kernel's ATM (Asynchronous Transfer Mode) networking subsystem contains a use of an unvalidated pointer in the sigd_send() function. In the ATM send path (sendmsg -> vcc_sendmsg -> sigd_send), the kernel reads a virtual circuit connection (vcc) pointer directly from the msg structure passed from userspace without any validation. This pointer can be arbitrarily forged by a user who has obtained the privileged signaling daemon role via the ATMSIGD_CTRL ioctl, allowing them to supply a fake pointer (e.g., 0xdeadbeef) that the kernel subsequently dereferences [1].

To exploit this vulnerability, an attacker must first gain the ability to act as the ATM signaling daemon, which is achieved by opening an AF_ATMSVC socket and issuing the ATMSIGD_CTRL ioctl. Once in this privileged role, the attacker can craft a sendmsg() call with a msghdr structure containing a fabricated vcc pointer. The kernel does not verify that this pointer corresponds to an actual, allocated VCC before dereferencing it, leading to a crash when an invalid address is accessed [1].

The impact is limited to a denial of service (system crash) due to a kernel NULL pointer dereference or access to invalid memory. The CVSS v3 score of 5.5 (Medium) reflects this availability impact, with an attack vector that requires local access and high privileges (the attacker must already be able to control the signaling daemon role). No privilege escalation or data confidentiality breach is involved [1].

The fix, introduced in the Linux kernel commit series, adds a find_get_vcc() function that validates the vcc pointer by searching through vcc_hash (the global hash table of active VCCs) and acquiring a reference via sock_hold(). This ensures that only valid, allocated VCCs are used and that the memory remains valid while in use. The fix also notes a potential race condition with sigd_close(), but sock_hold() guarantees memory safety even in that scenario [1]. The security fix is included in upstream Linux kernel releases; users should apply the latest stable updates to mitigate this vulnerability.