CVE-2026-68302

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description Several AMT receive and transmit paths cache a pointer into the skb head and subsequently call helper functions that can reallocate that head before the cached pointer is reused. Functions such as pskb may pull(), ip mc may pull(), ipv6 mc may pull(), iptunnel pull header(), ip mc check igmp(), and ipv6 mc check mld() can free the old head and move the data, resulting in a dangling pointer and a use-after-free condition. Affected functions include amt rcv(), amt dev xmit(), amt multicast data handler(), amt membership query handler(), amt igmpv3 report handler(), amt mldv2 report handler(), and amt update handler(), which improperly cache pointers to ip hdr(), ipv6 hdr(), eth hdr(), or the AMT message header.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.