Astra Linux – vulnerability in linux-6.1, linux-6.12, linux-6.18

In the Linux kernel, the following vulnerability has been resolved: amt: Re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr, or the AMT message header and then call a helper that can reallocate that head...

SUSE CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

DEBIAN-CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

UBUNTU-CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968 amt: send the relay's General Query directly from the receive path

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968 amt: send the relay's General Query directly from the receive path

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968

The Linux kernel contains a use-after-free vulnerability in the amt driver. A socket buffer (skb) queued in a qdisc can outlive the tunnel it references because the tunnel pointer is stored as a raw pointer in skb->cb. Specifically, if a tunnel expires and is freed while a packet (e.g., one wi...

EUVD-2026-108762

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.16. It arises because amt devices’ buffers of skb objects reference the original pointers within their skb-cb fields. When these buffers are released due to a tunnel expiration, subsequent enqueuing operations trigger reuse after release i...

Linux Distros Unpatched Vulnerability : CVE-2026-98968

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb...