Cloudanix VulnDB

CVE-2026-68302

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Aug 10, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux network code that handles certain multicast tunnels can let remote attackers crash the system or potentially take it over.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel AMT code where cached skb header pointers (ip_hdr, ipv6_hdr, eth_hdr, AMT headers) dangle after pskb_may_pull, ip_mc_may_pull, ipv6_mc_may_pull, iptunnel_pull_header, ip_mc_check_igmp or ipv6_mc_check_mld reallocates the head; affected sites include amt_rcv, amt_dev_xmit, amt_multicast_data_handler, amt_membership_query_handler, amt_igmpv3_report_handler, amt_mldv2_report_handler and amt_update_handler.

Why it matters to the business

Linux systems using AMT multicast tunneling face risk of remote kernel crashes or memory corruption that can lead to denial of service or full system compromise when handling network traffic, with potential widespread impact on routers, servers and appliances.

How an attack unfolds

An attacker sends crafted AMT or multicast packets that reach the listed receive or transmit handlers, causing a header pointer to be cached before a pull operation reallocates the skb head and then triggering subsequent reads or writes through the now-invalid pointer.

How to fix it

Apply the upstream fix that either snapshots stable scalar values before the first pull or re-derives header pointers from the skb after the last reallocating call in each affected AMT function.

How to confirm the fix worked

Inspect kernel source or running binary for the corrected pattern of re-deriving headers after pulls in amt_rcv, amt_dev_xmit, amt_multicast_data_handler and related functions; test with crafted packets that previously triggered the UAF.

Typical attack path

  1. Send network packets that reach AMT receive or transmit paths
  2. Trigger caching of ip_hdr, ipv6_hdr or eth_hdr before a pull helper
  3. Cause pskb_may_pull or equivalent to reallocate the skb head
  4. Access the dangling pointer to read or write freed memory

How to detect it

Review kernel crash logs and dmesg for use-after-free reports or slab errors originating from amt_rcv, amt_dev_xmit or amt_*_handler functions during packet processing.

What your security team should do

  • Upgrade to a patched kernel as soon as available
  • Disable AMT interfaces if not required until patched
  • Monitor kernel logs for AMT-related crashes or slab corruption

The record

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header) and then call a helper that can reallocate that head before the cached pointer is used again. pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and ipv6_mc_check_mld() can all free the old head and move the data, so a pointer taken before the call dangles afterwards and the later access is a use-after-free of the freed head. The affected sites are: amt_rcv() caches ip_hdr() before amt_parse_type() pulls, then reads iph->saddr. amt_dev_xmit() caches ip_hdr()/ipv6_hdr() before ip_mc_check_igmp()/ ipv6_mc_check_mld() and pskb_may_pull(), then reads the group address. amt_multicast_data_handler() caches eth_hdr() before pskb_may_pull(), then writes the L2 header. amt_membership_query_handler() caches the AMT header, the outer and inner eth_hdr() and ip_hdr() before iptunnel_pull_header() and several pulls, then reads and writes them. amt_igmpv3_report_handler() and amt_mldv2_report_handler() cache ip_hdr()/ipv6_hdr() and the current group record and read the record count from the report header inside the record loop, across the *_mc_may_pull() calls. amt_update_handler() caches ip_hdr() and the AMT membership-update header before pskb_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and the report handler, then reads iph->daddr and amtmu->nonce / amtmu->response_mac. Fix each site by either snapshotting the scalar that is used after the pull before the first pull runs, or re-deriving the header pointer from the skb after the last pull that can move the head. Values that are stable across the pull (source and group address, the response MAC and nonce, the record count, the outer source MAC) are snapshotted; pointers that are written through or read repeatedly are re-derived.

Affected packages

Ecosystem Package Introduced Fixed