CVE-2026-68152: Linux Kernel AMT Use-After-Free Flaw

CVE-2026-68152 Overview

CVE-2026-68152 is a use-after-free vulnerability in the Linux kernel's Automatic Multicast Tunneling (AMT) driver. The flaw occurs when pending delayed works access the freed amt_dev structure after an AMT device is removed. A local attacker with low privileges can trigger the race condition to cause kernel crashes or memory corruption. The vulnerability affects the amt_dev_stop() teardown path, where cancel_delayed_work_sync() fails to prevent event_wq from rescheduling req_wq and discovery_wq items after cancellation.

Critical Impact
A local, low-privileged attacker can trigger a kernel use-after-free leading to memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel versions containing the AMT (Automatic Multicast Tunneling) driver
Distributions shipping vulnerable upstream kernels prior to the referenced stable patches
Systems with the amt kernel module loaded and in use

Discovery Timeline

2026-08-10 - CVE-2026-68152 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68152

Vulnerability Analysis

The vulnerability resides in the AMT driver's teardown logic. When the network device is removed, amt_dev_stop() invokes cancel_delayed_work_sync() on req_wq and discovery_wq to terminate outstanding delayed work items. However, event_wq remains capable of rescheduling these delayed works via mod_delayed_work() after cancellation completes. The resulting race allows kernel worker threads to dereference the freed amt_dev structure after the netdev has been released [CWE-416].

The upstream fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() inside amt_dev_stop(). This call both prevents further queuing of req_wq and discovery_wq items and waits for currently running work to finish. The patch also disables the delayed works immediately after initialization in amt_newlink(), enabling them only when the device is successfully opened. This aligns the work lifecycle with the device lifetime.

Root Cause

The root cause is incorrect synchronization between the AMT device teardown path and the event work queue. Because event_wq can requeue delayed works after cancel_delayed_work_sync() returns, freeing the amt_dev structure creates a dangling reference that later executes in kernel context.

Attack Vector

Exploitation requires local access with the ability to trigger AMT device removal while events are actively being processed. An attacker with permissions to create and destroy AMT netdev instances can race the teardown against event processing to cause a use-after-free. Successful exploitation can result in kernel memory corruption, denial of service, or, depending on heap layout, arbitrary kernel memory manipulation.

The vulnerability manifests in the AMT delayed work scheduling logic. See the Kernel Security Fix commit for the authoritative technical details.

Detection Methods for CVE-2026-68152

Indicators of Compromise

Kernel oops or panic messages referencing amt_event_work, amt_req_work, or amt_discovery_work in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads or writes within the amt module
Unexpected kernel crashes correlated with AMT interface teardown events

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test kernels to catch use-after-free conditions in the AMT driver
Monitor dmesg for stack traces containing AMT work queue function symbols followed by netdev unregister events
Audit uname -r across the fleet to identify kernels missing the referenced stable patches

Monitoring Recommendations

Alert on kernel crash telemetry that references the amt module or its work queue handlers
Track loading of the amt kernel module via auditd rules on init_module and finit_module syscalls
Correlate netdev lifecycle events with subsequent kernel warnings to surface race-window activity

How to Mitigate CVE-2026-68152

Immediate Actions Required

Apply the upstream stable kernel patches referenced by the fix commits 006340cf0688, 1a644db2cf59, a46bfa01e01d, and ea20c44935d6
Update to a distribution kernel that incorporates the AMT delayed work fix
Restrict the ability to create AMT interfaces to trusted administrators by controlling CAP_NET_ADMIN

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Refer to the Kernel Patch Update, Kernel Commit Changes, Kernel Code Enhancement, and Kernel Security Fix for the corresponding stable branch backports.

Workarounds

Blacklist the amt kernel module on systems that do not require Automatic Multicast Tunneling
Remove CAP_NET_ADMIN from untrusted users and containers to prevent AMT netdev creation and teardown
Disable unprivileged user namespaces where they are not required, reducing the ability of local users to reach the vulnerable code path

bash

# Blacklist the AMT module until patched kernels are deployed
echo 'blacklist amt' | sudo tee /etc/modprobe.d/blacklist-amt.conf
sudo modprobe -r amt

# Verify the module is not loaded
lsmod | grep amt