{"id":"CVE-2026-98968","kind":"vulnerability","aliases":["CVE-2026-98968"],"related":[],"title":"Linux kernel amt driver: use-after-free when a queued relay query outlives its tunnel","description":"In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb->cb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n  BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n  Call Trace:\n   amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n   dev_hard_start_xmit+0x22f/0x620\n   sch_direct_xmit+0x12e/0xac0\n   netem_dequeue+0x333/0xc50\n   net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb->cb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n   device's egress path: its qdisc, tc egress (clsact/tcx), the\n   netfilter egress hook and packet taps. They are still visible as\n   UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n   tx_dropped. The old query branch left through the unlock label,\n   which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n   such as a userspace querier, is now dropped at the IGMP/MLD type\n   switch. Before, it trusted whatever skb->cb held, and a NULL\n   tunnel hit the WARN_ON(1).","summary":"In the Linux kernel's amt tunnel driver, a General Query queued in a qdisc keeps a raw pointer to a tunnel that can be freed first, so dequeuing it causes a use-after-free. The sources do not describe what an attacker can do beyond the memory corruption and crash shown in the KASAN trace.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amt","kernel","linux","multicast","network-appliances","runtime"],"not_affected_if":["driver-not-loaded","no-amt-device"],"how_to_check":"- Check the kernel version with `uname -r` and whether the amt driver is loaded with `lsmod | grep amt`\n- Check whether an amt device is configured on the host with `ip -d link show type amt`","fix":"- Update the Linux kernel to a release that includes the upstream commit titled 'amt: send the relay's General Query directly from the receive path'; the fixed version numbers are unknown from the sources","status":"open","published_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:56:28+00:00","updated_at":"2026-10-25T04:56:28+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:56:28Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit titled 'amt: send the relay's General Query directly from the receive path'; the fixed version numbers are unknown from the sources","reach":"unknown","title":"Linux kernel amt driver: use-after-free when a queued relay query outlives its tunnel","impact":"medium","summary":"In the Linux kernel's amt tunnel driver, a General Query queued in a qdisc keeps a raw pointer to a tunnel that can be freed first, so dequeuing it causes a use-after-free. The sources do not describe what an attacker can do beyond the memory corruption and crash shown in the KASAN trace.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","amt","multicast","network-appliances"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory may crash or corrupt the system","analyst_note":"Find the fixed kernel versions and stable backport list from the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-98968) and the kernel git commit, and confirm whether an unprivileged remote attacker can trigger it.","how_to_check":"- Check the kernel version with `uname -r` and whether the amt driver is loaded with `lsmod | grep amt`\n- Check whether an amt device is configured on the host with `ip -d link show type amt`","needs_analyst":true,"not_affected_if":["no-amt-device","driver-not-loaded"],"who_is_affected":"Only hosts that run an amt (Automatic Multicast Tunneling) relay or gateway device with the amt driver loaded can hit this path, and the trigger shown needs a qdisc with a long delay on the amt device. Hosts without amt devices or without the driver can skip it. Whether the flaw is reachable by remote parties is unknown from the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000757,"input_tokens":4111,"output_tokens":692,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':188C,195C,203C,208C,212C,217C '-2026':18A,21A '-98968':19A,22A '1':136C,476C '1262':198C '135s':144C '180s':150C 'action':216C 'advertis':306C 'alreadi':248C 'amt':3A,23B,36B,98C,153C,174C,185C,192C,219C,224C,232C,243C,245C,275C,285C,304C,352C,355C,360C,381C,440C 'applianc':29B 'attack':74B 'back':273C 'behaviour':368C 'beyond':77B 'bh':240C 'branch':350C,423C 'bug':177C 'call':190C,230C,284C,294C 'caus':61B 'cb':128C,339C,357C,362C,466C 'chang':369C 'clsact/tcx':390C 'corrupt':80B 'count':416C,430C 'crash':82B 'creat':259C,331C 'cve':17A,20A 'delay':148C 'dequeu':59B,166C,211C 'dereferenc':323C 'describ':71B 'dev':175C,186C,193C,199C,268C,276C,353C,441C 'devic':154C,382C 'direct':105C,206C,295C 'driver':4A,38B 'drivers/net/amt.c':197C 'drop':419C,435C,455C 'egress':384C,389C,393C 'elsewher':447C 'ethernet':281C 'everi':431C 'exampl':130C 'expir':160C 'first':57B 'follow':93C 'found':257C,329C 'free':8A,66B,172C,183C 'freed':56B,163C 'general':40B,103C,374C 'gq':222C,227C 'handler':234C,247C 'hard':200C 'header':282C 'held':467C 'hit':472C 'hook':394C 'igmp':132C,221C 'igmp/mld':458C 'insid':235C,261C,324C 'instead':300C 'kasan':86B,178C 'keep':46B 'kernel':2A,24B,34B,91C 'label':428C 'lead':272C 'left':367C,424C 'linux':1A,25B,33B,90C 'live':142C 'lock':239C 'longer':377C,415C 'lookup':342C 'make':292C 'membership':287C 'memori':79B 'mld':226C 'multicast':26B 'need':346C 'net':214C 'netem':147C,210C 'netfilt':392C 'network':28B 'network-appli':27B 'never':314C 'noth':334C 'null':470C 'old':421C 'outliv':14A,117C,155C 'packet':396C 'pass':378C 'path':109C,311C,385C 'pointer':49B,125C 'qdisc':45B,115C,318C,387C 'qrv':133C 'queri':13A,41B,104C,253C,266C,288C,313C,349C,375C,408C,422C,433C,437C 'querier':452C 'queu':11A,42B,112C,264C 'queue':269C 'raw':48B,124C 'rcu':237C,326C 'rcv':244C 'reach':439C 'read':238C 'receiv':108C,310C 'refcount':344C 'refer':121C 'relay':12A,101C,139C,371C,445C 'remov':347C 'request':233C,246C 'resolv':97C 'runtim':30B 'sch':205C 'section':241C,263C,327C 'send':99C,220C,225C,286C,305C 'sender':299C 'sent':411C,432C 'set':134C 'shown':83B 'skb':111C,127C,338C,356C,361C,465C 'slab':180C 'slab-use-after-fre':179C 'sourc':68B 'start':201C 'still':400C 'store':336C 'strip':279C 'struct':359C 'subsequ':165C 'success':412C 'switch':460C 'tap':397C 'tc':388C 'trace':87B,191C 'transmit':307C 'trigger':167C 'trust':463C 'tunnel':16A,37B,52B,119C,141C,159C,251C,291C,320C,471C 'two':298C 'tx':215C,418C 'type':459C 'udp':403C 'underlay':406C 'unlock':427C 'use':6A,64B,170C,181C 'use-after-fre':5A,63B,169C 'user':366C 'userspac':451C 'visibl':401C 'vulner':94C 'wait':315C 'warn':474C 'way':303C 'whatev':464C 'x12e/0xac0':209C 'x22f/0x620':204C 'x2763/0x2e20':189C,196C 'x333/0xc50':213C 'x35c/0xa60':218C 'xmit':176C,187C,194C,202C,207C,270C,277C,354C,442C","nicknames":[],"mitigations":[],"who_affected":"Only hosts that run an amt (Automatic Multicast Tunneling) relay or gateway device with the amt driver loaded can hit this path, and the trigger shown needs a qdisc with a long delay on the amt device. Hosts without amt devices or without the driver can skip it. Whether the flaw is reachable by remote parties is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98968","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98968","severity":null,"published_at":"2026-10-23T13:17:18+00:00","modified_at":"2026-10-23T13:17:18+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}