EUVD-2026-108762
GHSA-phwh-mpfm-5g26
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend AMT request to relay over UDP underlay
-
DeliveryRelay creates short-lived tunnel and queues General Query
-
ExploitTunnel expires (igmp_qrv timeout) before qdisc dequeues packet
-
ExecutionDequeue dereferences freed tunnel via skb->cb in amt_dev_xmit
-
ImpactKernel use-after-free: crash or memory corruption
Vulnerability Assessment
| Exploitation Conditions | Requires the target to be running as a Linux AMT relay (the in-kernel amt driver, CONFIG_AMT, with a relay-mode amt device configured) - this is the exact feature whose receive path builds and queues the General Query. The use-after-free further requires that the queued query be delayed in the amt device's egress qdisc longer than the tunnel's lifetime; the repro uses a netem delay (180s) exceeding the 135s tunnel lifetime produced by igmp_qrv=1. LIMITING FACTORS: the AMT relay feature must be enabled and reachable, and the bug depends on a delaying qdisc / timing window that is absent from default configurations, making real-world triggering unlikely without such a setup. These conditions are why the input CVSS rates AC:H despite the network vector. |
| Impact | Signals point to a real but conditional kernel memory-safety bug rather than an active threat. The input CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1) frames it as a network-reachable, unauthenticated, high-complexity flaw with full C/I/A impact - consistent with a use-after-free in the AMT (Automatic Multicast Tunneling) driver's transmit path. However, the exploitation signals are modest: EPSS is 0.21% (10th percentile), there is NO CISA KEV listing, and no public exploit is identified - the five references are all git.kernel.org stable-tree patch commits, not proof-of-concept code. The vuln.today decision label is 'this_week' (patch promptly, not an emergency). The AC:H rating is corroborated by the description: the KASAN repro depends on an artificial netem qdisc delay (180s) exceeding the tunnel lifetime (135s with igmp_qrv=1), i.e. a timing/deployment-specific window that does not exist in default configurations. The description establishes availability impact (KASAN slab-use-after-free crash) with certainty; the C:H/I:H in the input vector reflect the general code-execution potential of a kernel UAF but are NOT demonstrated by the evidence, which only shows the crash path. Conflict to note: the Tags label this 'Information Disclosure', which does not match a transmit-path use-after-free (a memory-corruption/DoS-and-potential-LPE class) - verify categorization. Net: a legitimate fix-promptly kernel vulnerability whose real-world exploitability is sharply limited by requiring the AMT relay feature plus an unusual qdisc delay configuration. |
| Exploit ScenarioDerived | An attacker sends AMT relay request packets over the UDP underlay to a Linux host acting as an AMT relay, causing it to create a short-lived tunnel and queue a General Query for transmission. If the amt device's egress qdisc delays that packet (e.g. a netem delay longer than the tunnel's ~135s lifetime) the tunnel is freed before dequeue, and the subsequent amt_dev_xmit() dereferences the stale skb->cb pointer, producing a kernel use-after-free (observed as a KASAN crash). No public exploit code exists; triggering reliably requires the specific AMT relay plus delaying-qdisc configuration described. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
A use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver can be triggered when an IGMP/MLD General Query generated by an AMT relay sits in the amt device's egress qdisc longer than the tunnel object it references survives, so the tunnel is freed before dequeue and amt_dev_xmit() dereferences stale memory - KASAN reports a slab-use-after-free in amt_dev_xmit(). Only systems running the in-kernel amt driver (CONFIG_AMT) with a relay-mode device configured are exposed, and the known trigger additionally needs a delaying qdisc such as netem whose delay exceeds the tunnel lifetime (the repro uses a 180s netem delay against a 135s tunnel lifetime from igmp_qrv=1), which is why the assessed vector rates AC:H despite the network vector. Impact is scoped to a local kernel memory-safety fault with potential confidentiality and integrity effects and a realistic crash/availability outcome; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, with EPSS at 0.21% (10th percentile).
RemediationAI
Apply the vendor-released kernel updates - Linux 6.6.160, 6.12.113, 6.18.57, 7.2.11 or 7.3, or the corresponding stable commits afae89de73dd693cfa329580ba0fba63bd3f0a11, e7ea63b4195a150604993044ab574d8240f2a399, 95114e421196250e3d9662f12df442799477d3c3, 181cb48c1e9af6b402567e132f879f89d1c54131 and e7183b7d518ce8b3e1f7284f9881d7a87569df14 (see https://git.kernel.org/stable/c/e7183b7d518ce8b3e1f7284f9881d7a87569df14 and https://git.kernel.org/stable/c/afae89de73dd693cfa329580ba0fba63bd3f0a11); the patched code sends the relay's General Query directly from the receive path instead of via dev_queue_xmit(), eliminating the stale skb->cb pointer. Where updating must be staged, the trigger described in the advisory requires the queued query to be delayed in the amt device's egress qdisc beyond the tunnel lifetime, so removing or shortening delaying qdiscs (for example netem) on relay-mode amt devices - or avoiding tunnel lifetimes shorter than the configured delay, since igmp_qrv=1 yields a 135s lifetime - closes the documented path; this is a partial control only, since the underlying lifetime bug remains until the kernel is patched, and it also means traffic shaping and delay testing on the amt interface can no longer be used. Operators should also note that after patching, relay-originated General Queries bypass the amt egress qdisc, tc egress (clsact/tcx), the netfilter egress hook and packet taps, so any monitoring or filtering that depended on observing those queries there will need to be reworked to watch the underlay UDP traffic instead. No mitigation other than the upstream fix is provided by the vendor.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The AMT driver (drivers/net/amt.c) implements an Automatic Multicast Tunneling gateway/relay that carries multicast traffic, including IGMP and MLD membership queries, over UDP on an underlay network. In the vulnerable code, amt_send_igmp_gq() and amt_send_mld_gq() - called only from amt_request_handler() within the rcu_read_lock_bh() section of amt_rcv() - built a General Query packet and handed it to dev_queue_xmit(), which routed it back through amt_dev_xmit(). That transmit path stripped the Ethernet header and recovered the target tunnel from a raw pointer stashed in skb->cb rather than from a reference-counted handle. Because skb->cb contents are not lifetime-managed, an skb parked in a qdisc can outlive the tunnel it points at; when the tunnel expires and is freed and the qdisc later dequeues, amt_dev_xmit() dereferences the freed tunnel (slab-use-after-free, call trace amt_dev_xmit -> dev_hard_start_xmit -> sch_direct_xmit -> netem_dequeue -> net_tx_action). No CWE identifier is assigned in the source data; the defect class is a use-after-free / stale-pointer lifetime bug rooted in passing object identity through skb->cb across a queuing boundary. The fix removes the indirection entirely: the two senders now call amt_send_membership_query() directly for the tunnel they already found or created inside the RCU section, mirroring how amt_send_advertisement() transmits from the receive path, so the query never enters a qdisc, the tunnel is only dereferenced under RCU, and nothing is stored in skb->cb. The query branch of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb are deleted. This also changes behaviour: relay-generated General Queries no longer traverse the amt device's egress path (qdisc, tc egress clsact/tcx, netfilter egress hook, packet taps) though they remain visible as UDP on the underlay; successfully sent queries are no longer mis-accounted as tx_dropped; and queries arriving at amt_dev_xmit() from elsewhere, such as a userspace querier, are now dropped at the IGMP/MLD type switch instead of trusting skb->cb.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-triggered from the AMT receive path (AV:N, PR:N); AC:H for the required delaying-qdisc/tunnel-expiry timing window; evidence confirms a crash (A:H) while confidentiality/integrity impact from the UAF is only potential (C:L/I:L).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
amt: send the relay's General Query directly from the receive path
An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmp_qrv set to 1 on the relay a tunnel lives for 135s, so a netem delay of 180s on the amt device outlives it; when the tunnel expires and is freed, the subsequent dequeue triggers a use-after-free in amt_dev_xmit().
BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20 Call Trace: amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262] dev_hard_start_xmit+0x22f/0x620 sch_direct_xmit+0x12e/0xac0 netem_dequeue+0x333/0xc50 net_tx_action+0x35c/0xa60
amt_send_igmp_gq() and amt_send_mld_gq() are only called from amt_request_handler(), inside the rcu_read_lock_bh() section of amt_rcv(). amt_request_handler() already has the tunnel the query is for: it found or created it inside that section. Queuing the query with dev_queue_xmit() only leads back into amt_dev_xmit(), which strips the Ethernet header and calls amt_send_membership_query() for that tunnel.
Make that call directly from the two senders instead, the same way amt_send_advertisement() transmits from the receive path. The query never waits in a qdisc, the tunnel is only dereferenced inside the RCU section that found or created it, and nothing is stored in skb->cb, so no lookup or refcount is needed. Remove the query branch of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no users left.
Behaviour changes:
- The relay's own General Queries no longer pass through the amt
device's egress path: its qdisc, tc egress (clsact/tcx), the netfilter egress hook and packet taps. They are still visible as UDP on the underlay.
- A query that is sent successfully is no longer counted as
tx_dropped. The old query branch left through the unlock label, which counted every sent query as dropped.
- A query that reaches amt_dev_xmit() on a relay from elsewhere,
such as a userspace querier, is now dropped at the IGMP/MLD type switch. Before, it trusted whatever skb->cb held, and a NULL tunnel hit the WARN_ON(1).
Executive ViewAI
A high-severity memory safety flaw in the Linux kernel's AMT multicast tunneling driver affects only systems with the in-kernel AMT driver enabled and a relay-mode interface configured alongside a delaying network qdisc. Successful exploitation could lead to kernel crashes and potential confidentiality or integrity impacts, but the highly specific configuration prerequisites and lack of public exploit code substantially lower the immediate likelihood of real-world attack.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB