CVE-2026-68152

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the AMT delayed works. When an AMT device is removed, pending delayed works may access the freed amt dev structure, potentially leading to memory corruption or kernel crashes. This occurs because the amt dev stop() function cancels req wq and discovery wq using cancel delayed work sync(), but these works can be rescheduled by event wq after the cancellation. Consequently, delayed works can access the amt dev structure after the netdev has been released. The issue involves the amt dev stop() function and the amt event work() function, specifically when mod delayed work() is called on req wq during the device removal process.

Recommendations Update the Linux kernel to a version where the amt dev stop() function utilizes disable delayed work sync() to prevent req wq and discovery wq from being queued again and to ensure running work items complete before the device is freed.