External risk intelligence

Linux Kernel AMT Use-After-Free Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-68302

This vulnerability exists within the Linux kernel's AMT (Automatic Multicast Tunneling) implementation. While AMT is a networking protocol, it is typically used for specific multicast transit scenarios within controlled network environments rather than being a general-purpose, public-facing internet service.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in the Linux kernel's handling of network packet headers, specifically within the AMT (Automatic Multicast Tunneling) component. This issue could allow for unauthorized access and manipulation of data due to a flaw in how certain pointers are managed after data operations. While the technical details involve a use-after-free condition in network data processing, the broader implication relates to potential data integrity and confidentiality risks in systems utilizing this specific kernel functionality. The main concern at this time is confirming the relevance and potential exposure within our environment.

Flaw in network data handling.
Could impact data integrity and confidentiality.
Confirm relevance and exposure to our environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially exploit a use-after-free vulnerability in the Linux kernel's AMT component. This occurs when network packet processing functions cache a pointer to header information. If subsequent operations reallocate the packet's memory before the cached pointer is used again, the pointer becomes invalid, leading to a crash or potential code execution when accessed.

Network access required.
Packet processing triggers vulnerability.
Potential for system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's AMT implementation could affect network traffic handling. Specifically, a use-after-free condition may occur when processing AMT receive and transmit paths, potentially impacting the integrity of network packet data.

Network packet data could be affected.
A use-after-free condition may occur.
Network traffic integrity could be compromised.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's AMT implementation requires immediate attention from infrastructure and platform teams. The first step is to identify all instances of the affected Linux kernel, determine their network reachability and business criticality, and then pinpoint the accountable system owner for each. Remediation planning should be risk-based, considering the operational impact and available maintenance windows.

Infrastructure and Platform teams own remediation.
Verify affected kernel instances and reachability.
Plan risk-based remediation and vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel AMT component?

AMT stands for Automatic Multicast Tunneling. It is a feature within the Linux kernel that allows for the transmission of multicast network traffic across networks that do not natively support it. By creating these tunnels, the kernel enables multicast applications to communicate through infrastructure that would otherwise block or fail to route such data, essentially wrapping multicast packets inside standard unicast traffic.

How does this use-after-free vulnerability happen?

This vulnerability is a memory management error. When the kernel processes network packets, it often creates a shortcut—a pointer—to look at specific data headers. If the kernel then decides to reorganize or move that data in memory, the original shortcut might still point to the old, now-deleted location. Using that outdated, 'freed' pointer can lead to system instability or security compromises, as the program might access incorrect memory or malicious data.

Does any network traffic trigger this CVE-2026-68302 bug?

The issue is triggered specifically during AMT receive and transmit operations. The kernel functions involved must process incoming or outgoing AMT packets that require memory reallocation—such as when pulling headers or checking membership records. Simple, static network traffic that does not trigger these specific kernel memory operations will not cause the use-after-free condition.

Is my network environment at risk according to Halo Surface Signal?

Halo Surface Signal notes that this risk is 'Unlikely' for most environments. While the vulnerability is critical, the affected AMT component is typically used for specialized multicast transit rather than general public-facing internet services. It is most relevant in controlled network environments configured specifically for these multicast tunnels, making it less likely to be exposed via standard internet-facing endpoints.

What is the first step to address this Linux kernel issue?

You should begin by identifying which systems in your infrastructure are running a version of the Linux kernel that includes the vulnerable AMT implementation. Once identified, evaluate whether these systems actually utilize AMT tunnels. If the functionality is not in use, you may be able to disable or restrict the feature. Otherwise, coordinate with your system owners to prioritize and schedule the appropriate kernel updates provided by your distribution vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.