Linux Kernel EUVD-2026-55538

The Linux kernel AMT module (amt.ko) must be loaded on the target system - it is not loaded by default on most distributions and must be explicitly instantiated via 'ip link add type amt' or equivalent. The attacker must hold CAP_NET_ADMIN in the active network namespace, which is typically granted to root or can be obtained via user namespace in configurations where unprivileged user namespaces are enabled. The vulnerability is a race condition, meaning the attacker must win a timing window between cancel_delayed_work_sync() completion in amt_dev_stop() and the subsequent netdev freeing - this is not guaranteed on every attempt and may require repeated triggering. Remote exploitation is not possible; the attack vector is strictly local. Systems that do not load the AMT module, do not create AMT tunnel devices, or restrict CAP_NET_ADMIN via seccomp/AppArmor/SELinux profiles are not exposed.

The NVD CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) scores this at 7.8 High, reflecting a local low-privilege attack with full kernel-level impact potential - consistent with a use-after-free reachable from ring 3 that could yield a controlled write primitive for privilege escalation. However, AC:L appears optimistic for a race condition; winning the window between cancel_delayed_work_sync() and netdev freeing requires precise timing or repeated attempts, which in practice maps closer to AC:H. The EPSS score of 0.18% (7th percentile) strongly corroborates low real-world exploitation interest - a signal that even a mid-sized municipal IT team in zabrze should treat this as a routine patch-cycle patch rather than an emergency response. The vulnerability is absent from CISA KEV, no POC code has been identified, and the input tags it as 'Buffer Overflow,' which is a misclassification - the actual class is use-after-free, a distinction that matters for exploit technique and detection. The key limiting factor is that the AMT driver must be loaded and an AMT virtual device must be under active manipulation by the attacker, which is a non-default and infrastructure-specific condition. Overall, real-world risk is meaningful for Linux systems running AMT multicast tunneling but low for the broad Linux installed base.

A local attacker with a standard user account holding CAP_NET_ADMIN (or operating within a user/network namespace that grants it) creates an AMT virtual network device and then triggers rapid device teardown while concurrently generating AMT events, racing event_wq's re-scheduling of req_wq against the netdev freeing window. If the race is won, req_wq fires against freed memory, potentially allowing the attacker to corrupt kernel heap structures and escalate privileges to root. No public POC has been identified, and the narrow race window makes reliable exploitation non-trivial.