Cloudanix VulnDB

CVE-2026-98968

High · 8.1

CVSS

8.1

EPSS

0.5%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in Linux kernel multicast tunneling can let specially timed network packets cause crashes or allow attackers to run code on affected systems.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in amt_dev_xmit when an skb queued in a qdisc holds a raw pointer to a tunnel structure in skb->cb that is freed after the tunnel expires while still referenced during dequeue.

Why it matters to the business

Systems using Linux AMT multicast tunneling with traffic shaping or delays may experience kernel crashes, memory corruption, or potential remote code execution, leading to system instability or compromise; the issue is recent with low observed exploitation likelihood.

How an attack unfolds

An attacker configures igmp_qrv=1 on an AMT relay and applies a netem delay exceeding the tunnel lifetime (e.g., 180s) on the AMT device; when the tunnel is freed after 135s, a subsequent dequeue in net_tx_action triggers the use-after-free in amt_dev_xmit during IGMP/MLD general query handling.

How to fix it

Apply the upstream kernel fix that invokes amt_send_igmp_gq and amt_send_mld_gq directly from the receive path under RCU protection instead of queuing via dev_queue_xmit; remove the query branch from amt_dev_xmit along with amt_skb_cb and struct amt_skb_cb; monitor for stable kernel releases containing the resolution.

How to confirm the fix worked

Verify the fix is present by checking for direct calls to amt_send_membership_query from amt_request_handler within RCU sections and absence of skb->cb usage for tunnels; reproduce with KASAN enabled under the original igmp_qrv and netem conditions to confirm no slab-use-after-free occurs.

Typical attack path

  1. Set igmp_qrv to 1 on the AMT relay
  2. Apply a qdisc delay such as netem exceeding tunnel lifetime on the AMT device
  3. Trigger or wait for IGMP/MLD general query transmission from amt_request_handler
  4. Cause tunnel expiration and free while the skb remains queued
  5. Trigger skb dequeue to hit the freed tunnel pointer in amt_dev_xmit

How to detect it

Search kernel logs and KASAN reports for slab-use-after-free involving amt_dev_xmit and netem_dequeue; inspect network stack traces referencing amt_rcv or amt_request_handler around the time of tunnel expiration.

  • amt_dev_xmit+0x2763/0x2e20
  • BUG: KASAN: slab-use-after-free in amt_dev_xmit
  • amt_skb_cb

What your security team should do

  • Prioritize kernel updates for AMT-enabled systems once the fix is released in distribution kernels
  • Disable or avoid AMT interfaces combined with qdisc delays where possible until patched
  • Monitor KASAN and kernel logs for amt_dev_xmit use-after-free reports
  • Review multicast and IGMP configurations for unnecessary qrv settings or shaping rules

The record

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmp_qrv set to 1 on the relay a tunnel lives for 135s, so a netem delay of 180s on the amt device outlives it; when the tunnel expires and is freed, the subsequent dequeue triggers a use-after-free in amt_dev_xmit(). BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20 Call Trace: amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262] dev_hard_start_xmit+0x22f/0x620 sch_direct_xmit+0x12e/0xac0 netem_dequeue+0x333/0xc50 net_tx_action+0x35c/0xa60 amt_send_igmp_gq() and amt_send_mld_gq() are only called from amt_request_handler(), inside the rcu_read_lock_bh() section of amt_rcv(). amt_request_handler() already has the tunnel the query is for: it found or created it inside that section. Queuing the query with dev_queue_xmit() only leads back into amt_dev_xmit(), which strips the Ethernet header and calls amt_send_membership_query() for that tunnel. Make that call directly from the two senders instead, the same way amt_send_advertisement() transmits from the receive path. The query never waits in a qdisc, the tunnel is only dereferenced inside the RCU section that found or created it, and nothing is stored in skb->cb, so no lookup or refcount is needed. Remove the query branch of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no users left. Behaviour changes: - The relay's own General Queries no longer pass through the amt device's egress path: its qdisc, tc egress (clsact/tcx), the netfilter egress hook and packet taps. They are still visible as UDP on the underlay. - A query that is sent successfully is no longer counted as tx_dropped. The old query branch left through the unlock label, which counted every sent query as dropped. - A query that reaches amt_dev_xmit() on a relay from elsewhere, such as a userspace querier, is now dropped at the IGMP/MLD type switch. Before, it trusted whatever skb->cb held, and a NULL tunnel hit the WARN_ON(1).

Affected packages

Ecosystem Package Introduced Fixed