EUVD-2026-108762

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968

A use-after-free vulnerability exists in the Linux kernel within the AMT (AMT Device) driver. The issue occurs because an skb queued in a qdisc can outlive the tunnel it references via a raw pointer in skb->cb . Specifically, if a tunnel expires and is freed while a netem delay is still active...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: amt: The pointer to the skb header is reread after each pull operation. Several AMT receive and transmit paths cache the pointer to the skb header iphdr, ipv6hdr, ethhdr, or the AMT message header, and then call a helper...