CVE-2026-23286
MediumSummary
W jądrze Linuxa zidentyfikowano podatność polegającą na dereferencji wskaźnika NULL w funkcji lec_arp_clear_vccs(). Problem ten występuje, gdy wiele wpisów ARP dzieli ten sam VCC, co prowadzi do awarii systemu w przypadku zamknięcia VCC.
Risk Assessment
Podatność ta może prowadzić do awarii systemu, co może wpłynąć na dostępność usług korzystających z modułu ATM LANE. Organizacje powinny być świadome ryzyka związanego z nieprawidłowym zarządzaniem pamięcią w tym module.
Recommendation
Zaleca się aktualizację jądra Linuxa do wersji, w której wprowadzono poprawkę, aby uniknąć problemów związanych z dereferencją wskaźnika NULL oraz zapewnić stabilność systemu.
Related vulnerabilities
- CVE-2026-75969Critical
A missing authentication vulnerability in the firmware update mechanism of PTZOptics cameras and the Firmware Upgrade Tool allows an unauthenticated user to install modified firmware without administrator credentials. This affects many camera models and all versions of the Upgrade Tool.
- CVE-2026-62308Critical
In Tugtainer prior to version 1.30.6, an authenticated user can make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind SSRF.
- CVE-2026-55494Critical
In Tugtainer Agent prior to version 1.30.4, when AGENT_SECRET is not configured, Docker management APIs are accessible without authentication. The signature verification function in agent/auth.py returns success if Config.AGENT_SECRET is empty, making protected APIs accessible without authentication.
- CVE-2026-55181Critical
In Tugtainer prior to version 1.30.3, OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled, but a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects to the OIDC authorization endpoint. This bypasses the intended OIDC disable switch.
- CVE-2026-55176Critical
In Soft Machine versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the Fly app and is reachable from the user-facing process environment, any tenant can use it to authenticate to any other tenant's workspace API. This results in cross-workspace read, write, and destructive-restore primitives.
- CVE-2026-19445Critical
A remote, unauthenticated TLS client can crash a server or trigger a use-after-free if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.
- CVE-2026-102490Critical
All versions of Zammad including the latest alpha enable the local zammad user to escalate privileges to root.
- CVE-2026-102489Critical
Zammad versions 6.3.0 to 6.5.4 are vulnerable to a session hijack vulnerability that leads to remote code execution as the zammad user. The vulnerability is also present in version 7.0.0 to version 7.1.3, but not exploitable due to environment conditions.
- CVE-2026-103470Critical
In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate privileges.
- CVE-2026-102427Critical
Joomla Extension - OrdaSoft Joomla CCK before 8.3.16 has unauthenticated remote code execution. The file site/uploader.php is reached through normal frontend routing (task=getContent), with no authentication or ACL check. The handler validates the uploaded file's content with a real magic-byte MIME check, but the extension allow-list is commented out. The saved file's extension is taken directly from the attacker-supplied filename with no validation, and the file is written to a path under the Joomla web root executed by PHP. An image/PHP polyglot passed the content check with a .php extension.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: atm: lec: fix null-ptr-deref in lec_arp_clear_vccs syzkaller reported a null-ptr-deref in lec_arp_clear_vccs(). This issue can be easily reproduced using the syzkaller reproducer. In the ATM LANE (LAN Emulation) module, the same atm_vcc can be shared by multiple lec_arp_table entries (e.g., via entry->vcc or entry->recv_vcc). When the underlying VCC is closed, lec_vcc_close() iterates over all ARP entries and calls lec_arp_clear_vccs() for each matched entry. For example, when lec_vcc_close() iterates through the hlists in priv->lec_arp_empty_ones or other ARP tables: 1. In the first iteration, for the first matched ARP entry sharing the VCC, lec_arp_clear_vccs() frees the associated vpriv (which is vcc->user_back) and sets vcc->user_back to NULL. 2. In the second iteration, for the next matched ARP entry sharing the same VCC, lec_arp_clear_vccs() is called again. It obtains a NULL vpriv from vcc->user_back (via LEC_VCC_PRIV(vcc)) and then attempts to dereference it via `vcc->pop = vpriv->old_pop`, leading to a null-ptr-deref crash. Fix this by adding a null check for vpriv before dereferencing it. If vpriv is already NULL, it means the VCC has been cleared by a previous call, so we can safely skip the cleanup and just clear the entry's vcc/recv_vcc pointers. The entire cleanup block (including vcc_release_async()) is placed inside the vpriv guard because a NULL vpriv indicates the VCC has already been fully released by a prior iteration — repeating the teardown would redundantly set flags and trigger callbacks on an already-closing socket. The Fixes tag points to the initial commit because the entry->vcc path has been vulnerable since the original code. The entry->recv_vcc path was later added by commit 8d9f73c0ad2f ("atm: fix a memory leak of vcc->user_back") with the same pattern, and both paths are fixed here.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS