CVE-2026-98968— amt: send the relay's General Query directly from the receive path
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： amt：在接收路径中直接发送中继的通用查询（General Query） 当套接字缓冲区（skb）被加入队列 disciplines（qdisc）时，它可能通过 中的原始指针引用一个隧道，并在该隧道被释放后仍然存活。例如，若中继的 设置为 1，则隧道生命周期为 135 秒；此时若在 amt 设备上设置 180 秒的 netem 延迟，该 skb 的存活时间将超过隧道。当隧道到期并被释放后，随后的出队操作会在 中触发“释放后使用”（use-after-free）漏洞。 和
Possible ATT&CK Techniques 1 AI
T1069.002 · Domain GroupsAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | cbc21dc1cfe949e37b2a54c71511579f1899e8d4< 95114e421196250e3d9662f12df442799477d3c3 |
affected |
cbc21dc1cfe949e37b2a54c71511579f1899e8d4< e7183b7d518ce8b3e1f7284f9881d7a87569df14 |
affected | ||
cbc21dc1cfe949e37b2a54c71511579f1899e8d4< 181cb48c1e9af6b402567e132f879f89d1c54131 |
affected | ||
cbc21dc1cfe949e37b2a54c71511579f1899e8d4< e7ea63b4195a150604993044ab574d8240f2a399 |
affected | ||
cbc21dc1cfe949e37b2a54c71511579f1899e8d4< afae89de73dd693cfa329580ba0fba63bd3f0a11 |
affected | ||
5.16 |
affected | ||
< 5.16 |
unaffected | ||
6.6.160≤ 6.6.* |
unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-98968
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
amt: send the relay's General Query directly from the receive path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
amt: send the relay's General Query directly from the receive path
An skb queued in a qdisc can outlive the tunnel it references
through a raw pointer in skb->cb. For example, with igmp_qrv set
to 1 on the relay a tunnel lives for 135s, so a netem delay of
180s on the amt device outlives it; when the tunnel expires and is
freed, the subsequent dequeue triggers a use-after-free in
amt_dev_xmit().
BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20
Call Trace:
amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]
dev_hard_start_xmit+0x22f/0x620
sch_direct_xmit+0x12e/0xac0
netem_dequeue+0x333/0xc50
net_tx_action+0x35c/0xa60
amt_send_igmp_gq() and amt_send_mld_gq() are only called from
amt_request_handler(), inside the rcu_read_lock_bh() section of
amt_rcv(). amt_request_handler() already has the tunnel the query is
for: it found or created it inside that section. Queuing the query with
dev_queue_xmit() only leads back into amt_dev_xmit(), which strips the
Ethernet header and calls amt_send_membership_query() for that tunnel.
Make that call directly from the two senders instead, the same way
amt_send_advertisement() transmits from the receive path. The query
never waits in a qdisc, the tunnel is only dereferenced inside the
RCU section that found or created it, and nothing is stored in
skb->cb, so no lookup or refcount is needed. Remove the query branch
of amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no
users left.
Behaviour changes:
- The relay's own General Queries no longer pass through the amt
device's egress path: its qdisc, tc egress (clsact/tcx), the
netfilter egress hook and packet taps. They are still visible as
UDP on the underlay.
- A query that is sent successfully is no longer counted as
tx_dropped. The old query branch left through the unlock label,
which counted every sent query as dropped.
- A query that reaches amt_dev_xmit() on a relay from elsewhere,
such as a userspace querier, is now dropped at the IGMP/MLD type
switch. Before, it trusted whatever skb->cb held, and a NULL
tunnel hit the WARN_ON(1).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-98968
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-98968
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-98968 (5)
Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total
| CVE-2026-98959 | 9.8 CRITICAL | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-99079 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-99078 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-98870 | 8.8 HIGH | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-98988 | 8.8 HIGH | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE |
| CVE-2026-99083 | 8.8 HIGH | ksmbd: fix heap out-of-bounds write in krb5_authenticate() |
| CVE-2026-99082 | 8.8 HIGH | KVM: x86: Use active memslots for the per-vCPU MMIO cache |
| CVE-2026-98981 | 8.8 HIGH | namespace: unhash a dentry before detaching the mounts on it |
| CVE-2026-98980 | 8.8 HIGH | namei: don't reveal overmounted entries in refwalk |
| CVE-2026-99042 | 8.4 HIGH | io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 |
| CVE-2026-98978 | 8.4 HIGH | namespace: never expire a locked mount |
| CVE-2026-99064 | 8.1 HIGH | cipso: adjust cached option offsets when removing CIPSO |
| CVE-2026-98889 | 7.8 HIGH | wifi: iwlwifi: mvm: fix sched scan IE sizing |
| CVE-2026-98991 | 7.8 HIGH | namespace: queue a mount only once for mount notifications |
| CVE-2026-98944 | 7.8 HIGH | HID: steam: Refactor registration |
| CVE-2026-99056 | 7.8 HIGH | strparser: make sure __strp_recv isn't running before tearing down the parser |
| CVE-2026-98999 | 7.8 HIGH | drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin |
| CVE-2026-99054 | 7.8 HIGH | tipc: destroy topsrv workqueues before closing connections |
| CVE-2026-99032 | 7.8 HIGH | net/smc: protect clcsock lifetime in smc_getname |
| CVE-2026-98899 | 7.8 HIGH | netfilter: ipset: mark the rcu locked areas properly |
Showing top 20 of 218 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()