CVE-2026-68302
kernel: amt: re-read skb header pointers after every pull
Severity
UnknownRed Hat Product Security
CVSS
Review impact separately from score.
Published · August 10, 2026
Updated · October 30, 2026
Description
A flaw was found in the Linux kernel's Adjacency Management Protocol (AMT) implementation. Several AMT receive and transmit paths improperly cache pointers to socket buffer (skb) headers. When a helper function reallocates the skb head, these cached pointers become invalid, leading to a use-after-free vulnerability. An attacker could potentially exploit this flaw to cause a denial of service or achieve arbitrary code execution.
Statement
This vulnerability does not affect supported Red Hat Enterprise Linux releases because the Automatic Multicast Tunneling driver is not enabled or included in enterprise kernel builds. The issue stems from stale buffer pointer dereferences in the upstream tunneling implementation during packet processing, which could otherwise allow network-based denial of service. Because the vulnerable code is absent from default and supported Red Hat configurations, the operational risk to Red Hat environments is negligible.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE-825 · Expired Pointer Dereference