CVE-2026-68302 Overview
CVE-2026-68302 is a use-after-free vulnerability in the Linux kernel's Automatic Multicast Tunneling (AMT) driver. Several AMT receive and transmit paths cache pointers into the skb head, including ip_hdr(), ipv6_hdr(), eth_hdr(), and the AMT message header. These paths then call helpers that can reallocate the head before the cached pointer is reused. Functions such as pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp(), and ipv6_mc_check_mld() can free the old head and move the data. The dangling pointer is subsequently dereferenced, resulting in a use-after-free of the freed head.
Critical Impact
A remote attacker can trigger memory corruption in the kernel through crafted AMT multicast traffic, potentially leading to code execution or denial of service without authentication.
Affected Products
- Linux kernel branches containing the AMT driver (drivers/net/amt.c)
- Distributions shipping vulnerable kernel versions prior to the referenced stable commits
- Systems with the AMT tunneling module loaded and processing multicast traffic
Discovery Timeline
- 2026-08-10 - CVE-2026-68302 published to NVD
- 2026-08-13 - Last updated in NVD database
Technical Details for CVE-2026-68302
Vulnerability Analysis
The flaw resides in the Linux kernel AMT (Automatic Multicast Tunneling) implementation. Multiple functions in the AMT code path retain raw pointers into the socket buffer (skb) head across operations that may reallocate that head. When the kernel pulls additional bytes into the linear region of an skb, the underlying memory can be reallocated and copied to a new location. Any previously captured pointer becomes stale and points to freed memory.
The affected functions include amt_rcv(), which caches ip_hdr() before amt_parse_type() performs a pull, then later reads iph->saddr. In amt_dev_xmit(), the code caches ip_hdr() or ipv6_hdr() before invoking ip_mc_check_igmp(), ipv6_mc_check_mld(), and pskb_may_pull(). The functions amt_multicast_data_handler(), amt_membership_query_handler(), amt_igmpv3_report_handler(), amt_mldv2_report_handler(), and amt_update_handler() exhibit similar patterns across pull operations.
Root Cause
The root cause is improper lifetime management of pointers derived from skb head data. Kernel helpers that pull bytes into the linear area, including pskb_may_pull() and iptunnel_pull_header(), may call pskb_expand_head() internally. This reallocates the head buffer and frees the previous allocation. Cached header pointers taken before the pull dangle after the reallocation, and subsequent reads or writes touch freed memory [CWE-416].
Attack Vector
The vulnerability is reachable through network traffic destined for an AMT-enabled interface. A remote attacker can craft AMT-encapsulated IGMP or MLD messages that force the kernel through the affected code paths. Because the pull operations can occur on attacker-controlled payload lengths, the reallocation and subsequent dereference of freed memory can be triggered without authentication. Exploitation may lead to kernel information disclosure, denial of service, or arbitrary kernel code execution depending on the state of the freed slab.
No public proof-of-concept exploit is currently available. Technical details are documented in the upstream stable commits referenced by the Linux Kernel Commit series.
Detection Methods for CVE-2026-68302
Indicators of Compromise
- Unexpected kernel oops or panic messages referencing amt_rcv, amt_dev_xmit, amt_multicast_data_handler, amt_membership_query_handler, amt_igmpv3_report_handler, amt_mldv2_report_handler, or amt_update_handler in the kernel log
- KASAN reports flagging use-after-free access in the AMT driver on kernels compiled with memory sanitizers
- Unexplained crashes on hosts processing AMT tunneled multicast traffic from untrusted sources
Detection Strategies
- Monitor dmesg and /var/log/kern.log for kernel warnings, general protection faults, or slab corruption messages tied to the AMT module
- Audit loaded modules with lsmod | grep amt to identify hosts exposed to the vulnerable code path
- Correlate crash events with inbound UDP traffic on the AMT relay/gateway port to identify potential exploitation attempts
Monitoring Recommendations
- Enable kernel crash collection via kdump on hosts running AMT to capture forensic evidence of exploitation attempts
- Track ingress traffic patterns to AMT relays for anomalous IGMP/MLD report volumes or malformed AMT headers
- Alert on unexpected module loads of amt.ko on systems that should not process multicast tunneling
How to Mitigate CVE-2026-68302
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by commits 3656a79f, 7746d588, 7f48e3dd, 9005b221, and ca0e8b66 from the Linux stable tree
- Prioritize patching of AMT relay and gateway systems exposed to untrusted networks
- If AMT is not required, unload the amt module and blacklist it from automatic loading
Patch Information
The fix reworks each affected AMT function to either snapshot scalar values used after the pull, or to re-derive the header pointer from the skb after the last pull that may move the head. Values stable across the pull, such as source and group addresses, response MAC, nonce, record count, and outer source MAC, are captured into local variables. Pointers that are written through or read repeatedly are re-derived after the pull operations complete. Distribution vendors will backport these commits into their supported kernel branches.
Workarounds
- Unload the AMT module with modprobe -r amt on systems that do not require multicast tunneling
- Restrict inbound traffic to AMT UDP ports using netfilter/iptables rules to trusted peers only
- Deploy network segmentation to prevent untrusted networks from reaching AMT relay endpoints
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
