CVE-2026-68152

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68152", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.371Z", "datePublished": "2026-08-10T11:59:18.270Z", "dateUpdated": "2026-08-17T04:59:47.614Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T04:59:47.614Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: fix use-after-free in AMT delayed works\n\nWhen an AMT device is removed, pending delayed works can still access\nthe freed amt_dev structure, which may result in kernel crashes or\nmemory corruption.\n\namt_dev_stop() cancels req_wq and discovery_wq with\ncancel_delayed_work_sync(), but these works can be scheduled again\nfrom event_wq after the cancellation. This allows delayed works to\naccess the freed amt_dev structure after the netdev has been released.\n\nThe following is a simple race scenario:\n\nCPU0 CPU1\n\namt_dev_stop()\ncancel_delayed_work_sync()\n amt_event_work()\n mod_delayed_work(req_wq)\nfree netdev\n req_wq accesses freed amt_dev\n\nUse disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and\ndiscovery_wq from being queued again and wait for running work items\nto complete.\n\nThe delayed works are disabled after initialization in\namt_newlink() and enabled only when the device is successfully opened.\nThis keeps the delayed work lifecycle synchronized with the lifetime\nof the AMT device."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires triggering amt_dev_stop() via local rtnetlink (RTM_DELLINK/ip link del) or ndo_stop on an AMT gateway netdev; the UAF race in teardown is not reachable by remote UDP alone without this privileged local device-removal path.\nAC:L - The attacker controls both sides of the race by concurrently deleting/bringing down the AMT interface while flooding AMT UDP packets or letting discovery/request timers fire, reliably re-queuing req_wq/discovery_wq via amt_event_work during the cancel_work_sync window.\nPR:L - Creating, opening, and removing AMT virtual interfaces requires CAP_NET_ADMIN via rtnetlink, which unprivileged users can obtain inside a user network namespace (unshare -Urn), but not without any privileges at all.\nUI:N - No victim user interaction is required; a single attacker with namespace CAP_NET_ADMIN can create an AMT gateway, bring it up, and race interface teardown against self-generated AMT traffic or delayed-work events.\nS:U - Successful exploitation corrupts kernel heap memory and can escalate privileges within the same kernel, but does not inherently cross VM, container, or IOMMU security boundaries into a separate authority domain.\nC:H - Use-after-free of the amt_dev structure embedded in netdev private data allows accessing attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure through standard UAF exploitation techniques.\nI:H - The UAF on amt_dev delayed-work handlers can corrupt kernel heap metadata and adjacent objects, providing primitives for arbitrary kernel memory writes and potential code execution as acknowledged in the fix commit.\nA:H - Use-after-free in amt_req_work/amt_discovery_work accessing freed amt_dev during netdev teardown can cause kernel oops, panic, or hang, and the fix commit explicitly warns of kernel crashes and memory corruption."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/amt.c"], "versions": [{"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "1a644db2cf59f164cdf3c75995bab5aadc097528", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "006340cf06881b6ff49767d8b6f3c4f7b892670c", "status": "affected", "versionType": "git"}, {"version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "lessThan": "ea20c44935d6142daecfa9b39d635033a7553e1b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/amt.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.101", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.42", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.101"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.42"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2"}, {"url": "https://git.kernel.org/stable/c/1a644db2cf59f164cdf3c75995bab5aadc097528"}, {"url": "https://git.kernel.org/stable/c/006340cf06881b6ff49767d8b6f3c4f7b892670c"}, {"url": "https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}], "title": "amt: fix use-after-free in AMT delayed works", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/net/amt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "1a644db2cf59f164cdf3c75995bab5aadc097528", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "006340cf06881b6ff49767d8b6f3c4f7b892670c", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}, {"lessThan": "ea20c44935d6142daecfa9b39d635033a7553e1b", "status": "affected", "version": "cbc21dc1cfe949e37b2a54c71511579f1899e8d4", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/net/amt.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.101", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.42", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: fix use-after-free in AMT delayed works\n\nWhen an AMT device is removed, pending delayed works can still access\nthe freed amt_dev structure, which may result in kernel crashes or\nmemory corruption.\n\namt_dev_stop() cancels req_wq and discovery_wq with\ncancel_delayed_work_sync(), but these works can be scheduled again\nfrom event_wq after the cancellation. This allows delayed works to\naccess the freed amt_dev structure after the netdev has been released.\n\nThe following is a simple race scenario:\n\nCPU0 CPU1\n\namt_dev_stop()\ncancel_delayed_work_sync()\n amt_event_work()\n mod_delayed_work(req_wq)\nfree netdev\n req_wq accesses freed amt_dev\n\nUse disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and\ndiscovery_wq from being queued again and wait for running work items\nto complete.\n\nThe delayed works are disabled after initialization in\namt_newlink() and enabled only when the device is successfully opened.\nThis keeps the delayed work lifecycle synchronized with the lifetime\nof the AMT device."}], "id": "CVE-2026-68152", "lastModified": "2026-08-17T05:18:15.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-10T13:20:01.290", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/006340cf06881b6ff49767d8b6f3c4f7b892670c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1a644db2cf59f164cdf3c75995bab5aadc097528"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel AMT: Use-after-free due to race condition in delayed works", "id": "2513338", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513338"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["In the Linux kernel, the following vulnerability has been resolved:\namt: fix use-after-free in AMT delayed works\nWhen an AMT device is removed, pending delayed works can still access\nthe freed amt_dev structure, which may result in kernel crashes or\nmemory corruption.\namt_dev_stop() cancels req_wq and discovery_wq with\ncancel_delayed_work_sync(), but these works can be scheduled again\nfrom event_wq after the cancellation. This allows delayed works to\naccess the freed amt_dev structure after the netdev has been released.\nThe following is a simple race scenario:\nCPU0 CPU1\namt_dev_stop()\ncancel_delayed_work_sync()\namt_event_work()\nmod_delayed_work(req_wq)\nfree netdev\nreq_wq accesses freed amt_dev\nUse disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and\ndiscovery_wq from being queued again and wait for running work items\nto complete.\nThe delayed works are disabled after initialization in\namt_newlink() and enabled only when the device is successfully opened.\nThis keeps the delayed work lifecycle synchronized with the lifetime\nof the AMT device.", "A flaw was found in the Linux kernel's AMT (Accelerated Mobile Page) device driver. A use-after-free vulnerability can occur due to a race condition during device removal. This allows delayed work items to access a freed memory structure, potentially leading to kernel crashes or memory corruption. An attacker could exploit this to impact system stability or integrity."], "name": "CVE-2026-68152", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T11:59:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68152\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68152\nhttps://git.kernel.org/stable/c/006340cf06881b6ff49767d8b6f3c4f7b892670c\nhttps://git.kernel.org/stable/c/1a644db2cf59f164cdf3c75995bab5aadc097528\nhttps://git.kernel.org/stable/c/a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2\nhttps://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,1a644db2cf59f164cdf3c75995bab5aadc097528)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,006340cf06881b6ff49767d8b6f3c4f7b892670c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cbc21dc1cfe949e37b2a54c71511579f1899e8d4,ea20c44935d6142daecfa9b39d635033a7553e1b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.101,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.42,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T14:15:03.849615+00:00", "updated": "2026-08-14T01:45:08.198693+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}