Skip to main content

Linux Kernel EUVDEUVD-2026-55538

| CVE-2026-68152 HIGH
2026-08-10 Linux GHSA-3v9r-4x9w-8c55
Buffer Overflow Linux Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Race condition exploitation requires winning a narrow timing window (AC:H); low-privilege local access with CAP_NET_ADMIN to manage network devices maps to PR:L; scope unchanged as impact is confined to the vulnerable kernel.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:33 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
7.8 (HIGH)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:59 cve.org
UNKNOWN (no severity yet)
CVE Published
Aug 10, 2026 - 11:59 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

amt: fix use-after-free in AMT delayed works

When an AMT device is removed, pending delayed works can still access the freed amt_dev structure, which may result in kernel crashes or memory corruption.

amt_dev_stop() cancels req_wq and discovery_wq with cancel_delayed_work_sync(), but these works can be scheduled again from event_wq after the cancellation. This allows delayed works to access the freed amt_dev structure after the netdev has been released.

The following is a simple race scenario:

CPU0 CPU1

amt_dev_stop() cancel_delayed_work_sync() amt_event_work() mod_delayed_work(req_wq) free netdev req_wq accesses freed amt_dev

Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and discovery_wq from being queued again and wait for running work items to complete.

The delayed works are disabled after initialization in amt_newlink() and enabled only when the device is successfully opened. This keeps the delayed work lifecycle synchronized with the lifetime of the AMT device.

AnalysisAI

Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the Linux kernel AMT driver (drivers/net/amt.c), which implements RFC 7450 Automatic Multicast Tunneling over unicast networks. Three workqueues coordinate AMT operation: req_wq (registration), discovery_wq (gateway discovery), and event_wq (event handling). The root cause is a use-after-free race condition - functionally CWE-416, though CWE is listed as N/A in the source data. The original teardown path called cancel_delayed_work_sync(), which cancels pending items but does not prevent subsequent re-queuing; event_wq's amt_event_work() handler calls mod_delayed_work(req_wq) after cancellation completes, requeuing req_wq before the netdev memory is released. Once the netdev is freed, req_wq fires and dereferences the stale amt_dev pointer, producing memory corruption or a kernel oops. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync(), which atomically disables re-queuing, drains running items, and prevents future scheduling - synchronizing the delayed-work lifecycle with the AMT device lifetime. The affected code was introduced in Linux 5.16 (commit cbc21dc1cfe949e37b2a54c71511579f1899e8d4). CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched kernel release: 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 or later, using the upstream stable commits listed in the references above. A reboot is required to load the updated kernel. For distribution-packaged kernels, apply the next security update that incorporates one of the four upstream fix commits; verify the commit SHA is present in the running kernel's changelog. As a compensating control where AMT multicast tunneling is not operationally required, block the AMT module from loading by adding 'blacklist amt' to /etc/modprobe.d/blocklist.conf and running 'depmod -a', then removing the currently loaded module with 'rmmod amt' if it is present - this completely eliminates the attack surface with no functional impact to systems not using IP multicast tunneling. Network-level controls (filtering multicast traffic) do not mitigate this vulnerability because exploitation is local, not remote.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-55538 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy