LiveActive security incident?Get immediate response
CVE Record

CVE-2026-68302: amt: re-read skb header pointers after every pull

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header) and then call a helper that can reallocate that head before the cached pointer is used again. pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and ipv6_mc_check_mld() can all free the old head and move the data, so a pointer taken before the call dangles afterwards and the later access is a use-after-free of the freed head. The affected sites are: amt_rcv() caches ip_hdr() before amt_parse_type() pulls, then reads iph->saddr. amt_dev_xmit() caches ip_hdr()/ipv6_hdr() before ip_mc_check_igmp()/ ipv6_mc_check_mld() and pskb_may_pull(), then reads the group address. amt_multicast_data_handler() caches eth_hdr() before pskb_may_pull(), then writes the L2 header. amt_membership_query_handler() caches the AMT header, the outer and inner eth_hdr() and ip_hdr() before iptunnel_pull_header() and several pulls, then reads and writes them. amt_igmpv3_report_handler() and amt_mldv2_report_handler() cache ip_hdr()/ipv6_hdr() and the current group record and read the record count from the report header inside the record loop, across the *_mc_may_pull() calls. amt_update_handler() caches ip_hdr() and the AMT membership-update header before pskb_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and the report handler, then reads iph->daddr and amtmu->nonce / amtmu->response_mac. Fix each site by either snapshotting the scalar that is used after the pull before the first pull runs, or re-deriving the header pointer from the skb after the last pull that can move the head. Values that are stable across the pull (source and group address, the response MAC and nonce, the record count, the outer source MAC) are snapshotted; pointers that are written through or read repeatedly are re-derived.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux AMT networking flaw can leave the kernel using memory after it has been freed while processing packets. The supplied CVSS assessment rates remote compromise as possible without authentication or user interaction, with potential confidentiality, integrity, and availability impact. Actual exploitability depends on AMT exposure and conditions not fully documented in the sources.

Executive priority

Treat as an urgent kernel patching and exposure-validation issue, especially for systems using AMT on untrusted networks. The theoretical impact is critical, but active exploitation is not established. Request rapid inventory, vendor-version mapping, prioritized remediation, and confirmation that updated kernels are running.

Technical view

Multiple AMT receive and transmit paths retain pointers into an skb head across helpers that may reallocate that head. Later reads or writes can therefore dereference freed memory. Stable fixes snapshot values needed after a pull or re-derive header pointers after the final operation capable of moving the skb head.

Likely exposure

The bundle marks Linux versions 5.16, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2 as affected, but also contains an unexplained “0” entry. Prioritize hosts using or exposing Linux AMT networking. The sources do not establish configuration prerequisites or distribution-specific package ranges.

Exploitation context

The supplied CVSS 3.1 vector is 9.8: network-accessible, low complexity, no privileges, and no user interaction. However, the bundle states KEV is false and provides no evidence of active exploitation or a public exploit. Treat the score as potential impact, not confirmation that every affected host is practically exploitable.

Researcher notes

The defect spans amt_rcv, amt_dev_xmit, multicast-data, membership-query, IGMPv3, MLDv2, and update handlers. Relevant pull and validation helpers may relocate skb data, invalidating cached IP, IPv6, Ethernet, AMT, or group-record pointers. The bundle provides fixes but lacks crash evidence, exploitability analysis, configuration requirements, and clear version-range semantics.

Mitigation direction

  • Apply the applicable vendor kernel update containing the referenced stable fix.
  • Consult distribution advisories to map kernel package versions to the upstream fixes.
  • Prioritize internet-facing or untrusted-network systems using AMT functionality.
  • Where patching is delayed, restrict AMT network exposure if operationally safe.

Validation and detection

  • Record each host’s running kernel and distribution package version.
  • Determine whether AMT functionality is enabled, used, or reachable from untrusted networks.
  • Confirm the installed kernel includes the applicable upstream fix or vendor backport.
  • Reboot updated systems and verify the patched kernel is actually running.
  • Monitor vendor advisories for clarified affected-version and configuration guidance.
Prepared
Confidence
medium
Sources
8

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-68302 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
7Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-68302Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxcbc21dc1cfe949e37b2a54c71511579f1899e8d4, cbc21dc1cfe949e37b2a54c71511579f1899e8d4, cbc21dc1cfe949e37b2a54c71511579f1899e8d4, cbc21dc1cfe949e37b2a54c71511579f1899e8d4, cbc21dc1cfe949e37b2a54c71511579f1899e8d4, cbc21dc1cfe949e37b2a54c71511579f1899e8d4unaffected
LinuxLinux5.16, 0, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.