{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98968", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.383Z", "datePublished": "2026-10-23T12:19:39.236Z", "dateUpdated": "2026-10-30T12:40:34.695Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:40:34.695Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n Call Trace:\n amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n dev_hard_start_xmit+0x22f/0x620\n sch_direct_xmit+0x12e/0xac0\n netem_dequeue+0x333/0xc50\n net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n device's egress path: its qdisc, tc egress (clsact/tcx), the\n netfilter egress hook and packet taps. They are still visible as\n UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n tx_dropped. The old query branch left through the unlock label,\n which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n such as a userspace querier, is now dropped at the IGMP/MLD type\n switch. Before, it trusted whatever skb->cb held, and a NULL\n tunnel hit the WARN_ON(1)." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - A routable UDP AMT_MSG_REQUEST enters udp_rcv() and amt_rcv(), and amt_request_handler() uses its source tuple, nonce, and p bit in the patched amt_send_igmp_gq()/amt_send_mld_gq(); the resulting query later dequeues into patched amt_dev_xmit().\nAC:H - The remote attacker can send the Request and let the tunnel expire, but cannot arrange the required relay-local queue retention: the demonstrated trigger uses igmp_qrv=1 for a 135-second amt_gmi() and a 180-second netem delay. Success therefore depends on target state outside remote control.\nPR:N - The relay branch of amt_rcv() dispatches AMT_MSG_REQUEST directly to amt_request_handler(), which checks only length and reserved/version bits before creating a tunnel; it requires no Discovery state, nonce/MAC validation, credentials, or capability.\nUI:N - Once the relay and delaying qdisc exist, the attacker only sends a Request; amt_request_handler() schedules gc_wq, and amt_tunnel_expire() plus netem dequeue run without victim action.\nS:U - The freed amt_tunnel_list and the accesses from amt_dev_xmit()/amt_send_membership_query() remain within the relay host's kernel; no VM, IOMMU, or other authority boundary is crossed.\nC:H - amt_send_membership_query() reads freed tunnel->ip4, source_port, nonce, and mac, and emits the nonce and MAC in an outbound AMT Membership Query; reclaiming the slab makes this a kernel UAF disclosure primitive.\nI:H - After transmission, amt_update_relay_status() executes spin_lock_bh(&tunnel->lock) and writes tunnel->status through the freed or reallocated amt_tunnel_list, enabling kernel heap corruption and potential control-flow hijacking.\nA:H - The delayed dequeue in amt_dev_xmit() produced the reported KASAN slab-use-after-free; its stale routing, lock, and status accesses can oops, panic, or hang the kernel, and new Requests can trigger it again after tunnel expiry." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/amt.c", "include/net/amt.h" ], "versions": [ { "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "423a46053788ec4a021d57e69d66db7f7f550da4", "status": "affected", "versionType": "git" }, { "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "95114e421196250e3d9662f12df442799477d3c3", "status": "affected", "versionType": "git" }, { "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "e7183b7d518ce8b3e1f7284f9881d7a87569df14", "status": "affected", "versionType": "git" }, { "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "181cb48c1e9af6b402567e132f879f89d1c54131", "status": "affected", "versionType": "git" }, { "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "e7ea63b4195a150604993044ab574d8240f2a399", "status": "affected", "versionType": "git" }, { "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "afae89de73dd693cfa329580ba0fba63bd3f0a11", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/net/amt.c", "include/net/amt.h" ], "versions": [ { "version": "5.16", "status": "affected" }, { "version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.113", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.11", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.191" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.113" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.57" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/423a46053788ec4a021d57e69d66db7f7f550da4" }, { "url": "https://git.kernel.org/stable/c/95114e421196250e3d9662f12df442799477d3c3" }, { "url": "https://git.kernel.org/stable/c/e7183b7d518ce8b3e1f7284f9881d7a87569df14" }, { "url": "https://git.kernel.org/stable/c/181cb48c1e9af6b402567e132f879f89d1c54131" }, { "url": "https://git.kernel.org/stable/c/e7ea63b4195a150604993044ab574d8240f2a399" }, { "url": "https://git.kernel.org/stable/c/afae89de73dd693cfa329580ba0fba63bd3f0a11" } ], "title": "amt: send the relay's General Query directly from the receive path", "x_generator": { "engine": "bippy-1.2.0" } } } }