{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-68152",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-68152"
  ],
  "published": "2026-08-10T12:08:00Z",
  "summary": "amt: fix use-after-free in AMT delayed works",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\namt: fix use-after-free in AMT delayed works\n\nWhen an AMT device is removed, pending delayed works can still access\nthe freed amt_dev structure, which may result in kernel crashes or\nmemory corruption.\n\namt_dev_stop() cancels req_wq and discovery_wq with\ncancel_delayed_work_sync(), but these works can be scheduled again\nfrom event_wq after the cancellation. This allows delayed works to\naccess the freed amt_dev structure after the netdev has been released.\n\nThe following is a simple race scenario:\n\nCPU0                         CPU1\n\namt_dev_stop()\ncancel_delayed_work_sync()\n                             amt_event_work()\n                             mod_delayed_work(req_wq)\nfree netdev\n                             req_wq accesses freed amt_dev\n\nUse disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and\ndiscovery_wq from being queued again and wait for running work items\nto complete.\n\nThe delayed works are disabled after initialization in\namt_newlink() and enabled only when the device is successfully opened.\nThis keeps the delayed work lifecycle synchronized with the lifetime\nof the AMT device.",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": null,
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-68152"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/1a644db2cf59f164cdf3c75995bab5aadc097528"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/006340cf06881b6ff49767d8b6f3c4f7b892670c"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-17T05:24:08Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Exploitation requires triggering amt_dev_stop() via local rtnetlink (RTM_DELLINK/ip link del) or ndo_stop on an AMT gateway netdev; the UAF race in teardown is not reachable by remote UDP alone without this privileged local device-removal path.\nAC:L - The attacker controls both sides of the race by concurrently deleting/bringing down the AMT interface while flooding AMT UDP packets or letting discovery/request timers fire, reliably re-queuing req_wq/discovery_wq via amt_event_work during the cancel_work_sync window.\nPR:L - Creating, opening, and removing AMT virtual interfaces requires CAP_NET_ADMIN via rtnetlink, which unprivileged users can obtain inside a user network namespace (unshare -Urn), but not without any privileges at all.\nUI:N - No victim user interaction is required; a single attacker with namespace CAP_NET_ADMIN can create an AMT gateway, bring it up, and race interface teardown against self-generated AMT traffic or delayed-work events.\nS:U - Successful exploitation corrupts kernel heap memory and can escalate privileges within the same kernel, but does not inherently cross VM, container, or IOMMU security boundaries into a separate authority domain.\nC:H - Use-after-free of the amt_dev structure embedded in netdev private data allows accessing attacker-influenced freed heap memory, enabling arbitrary kernel memory disclosure through standard UAF exploitation techniques.\nI:H - The UAF on amt_dev delayed-work handlers can corrupt kernel heap metadata and adjacent objects, providing primitives for arbitrary kernel memory writes and potential code execution as acknowledged in the fix commit.\nA:H - Use-after-free in amt_req_work/amt_discovery_work accessing freed amt_dev during netdev teardown can cause kernel oops, panic, or hang, and the fix commit explicitly warns of kernel crashes and memory corruption."
    }
  }
}