CyberSecBulletin
CVE-2026-43050NVD status: Analyzed

Linux: Use After Free

Published Updated By the CyberSecBulletin desk

CVE-2026-43050 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.0 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 3e8b25f32f2f35549d03d77da030a24a45bdef5b, 750a33f417f3d196b86375f8d9f8938bacf130fe, 317843d5355062020649124eb4a0d7acbcc3f53e as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.12% chance of exploitation within 30 days, which is low compared with other CVEs.

Next patch cycle

High severity with no evidence of exploitation so far.

What to do

  1. Update Linux to 3e8b25f32f2f35549d03d77da030a24a45bdef5b or 750a33f417f3d196b86375f8d9f8938bacf130fe or 317843d5355062020649124eb4a0d7acbcc3f53e or b256d055da47258e63f8b40965f276c5f23d229a, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.253 or 5.15.203 or 6.1.168 or 6.6.134, whichever matches your release line, or a later version.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3e8b25f32f2f35549d03d77da030a24a45bdef5b; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 750a33f417f3d196b86375f8d9f8938bacf130fe; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 317843d5355062020649124eb4a0d7acbcc3f53e; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, b256d055da47258e63f8b40965f276c5f23d229a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 3989740fa4978e1d2d51ecc62be1b01093e104ad; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, abc10f85a3965ac14b9ed7ad3e67b35604a63aa3; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 5fbbb1ff936d7ff9528d929c1549977e8123d8a8; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 up to, but not including, 922814879542c2e397b0e9641fd36b8202a8e555; and 1 more ranges3e8b25f32f2f35549d03d77da030a24a45bdef5b, 750a33f417f3d196b86375f8d9f8938bacf130fe, 317843d5355062020649124eb4a0d7acbcc3f53e, b256d055da47258e63f8b40965f276c5f23d229a, 3989740fa4978e1d2d51ecc62be1b01093e104ad, abc10f85a3965ac14b9ed7ad3e67b35604a63aa3
LinuxLinux Kernel2.6.12.1 up to, but not including, 5.10.253; 5.11 up to, but not including, 5.15.203; 5.16 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.134; 6.7 up to, but not including, 6.12.81; 6.13 up to, but not including, 6.18.22; 6.19 up to, but not including, 6.19.12; 2.6.12; and 1 more ranges5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
HighSuccess depends on conditions outside the attacker's control.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.

Official description

In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix use-after-free in sock_def_readable() A race condition exists between lec_atm_close() setting priv->lecd to NULL and concurrent access to priv->lecd in send_to_lecd(), lec_handle_bridge(), and lec_atm_send(). When the socket is freed via RCU while another thread is still using it, a use-after-free occurs in sock_def_readable() when accessing the socket's wait queue. The root cause is that lec_atm_close() clears priv->lecd without any synchronization, while callers dereference priv->lecd without any protection against concurrent teardown. Fix this by converting priv->lecd to an RCU-protected pointer: - Mark priv->lecd as __rcu in lec.h - Use rcu_assign_pointer() in lec_atm_close() and lecd_attach() for safe pointer assignment - Use rcu_access_pointer() for NULL checks that do not dereference the pointer in lec_start_xmit(), lec_push(), send_to_lecd() and lecd_attach() - Use rcu_read_lock/rcu_dereference/rcu_read_unlock in send_to_lecd(), lec_handle_bridge() and lec_atm_send() to safely access lecd - Use rcu_assign_pointer() followed by synchronize_rcu() in lec_atm_close() to ensure all readers have completed before proceeding. This is safe since lec_atm_close() is called from vcc_release() which holds lock_sock(), a sleeping lock. - Remove the manual sk_receive_queue drain from lec_atm_close() since vcc_destroy_socket() already drains it after lec_atm_close() returns. v2: Switch from spinlock + sock_hold/put approach to RCU to properly fix the race. The v1 spinlock approach had two issues pointed out by Eric Dumazet: 1. priv->lecd was still accessed directly after releasing the lock instead of using a local copy. 2. The spinlock did not prevent packets being queued after lec_atm_close() drains sk_receive_queue since timer and workqueue paths bypass netif_stop_queue(). Note: Syzbot patch testing was attempted but the test VM terminated unexpectedly with "Connection to localhost closed by remote host", likely due to a QEMU AHCI emulation issue unrelated to this fix. Compile testing with "make W=1 net/atm/lec.o" passes cleanly.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.

How developers prevent this class of flaw

  • Choose a language that provides automatic memory management.
  • When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

More Use After Free vulnerabilities (CWE-416)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: partial).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Use After Free vulnerabilities

Spotted an error? Tell us.