CVE-2026-68152: amt: fix use-after-free in AMT delayed works
In the Linux kernel, the following vulnerability has been resolved:
amt: fix use-after-free in AMT delayed works
When an AMT device is removed, pending delayed works can still access the freed amtdev structure, which may result in kernel crashes or memory corruption.
amtdevstop() cancels reqwq and discoverywq with canceldelayedworksync(), but these works can be scheduled again from eventwq after the cancellation. This allows delayed works to access the freed amtdev structure after the netdev has been released.
The following is a simple race scenario:
CPU0 CPU1
amtdevstop() canceldelayedworksync() amteventwork() moddelayedwork(reqwq) free netdev reqwq accesses freed amtdev
Use disabledelayedworksync() in amtdevstop() to prevent reqwq and discoverywq from being queued again and wait for running work items to complete.
The delayed works are disabled after initialization in amtnewlink() and enabled only when the device is successfully opened. This keeps the delayed work lifecycle synchronized with the lifetime of the AMT device.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the AMT device stop path (amt_dev_stop()), add/use disable_delayed_work_sync() so that req_wq (and related delayed work) cannot be queued again and running delayed work items are synchronized before freeing related resources.
Linux kernel (AMT delayed works) Call disable_delayed_work_sync() in amt_dev_stop() = Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq from being queued again and wait for running work items to complete - Compensating control
Ensure that when the AMT device is removed, pending delayed works are cancelled and synchronized with the lifetime of the amt_dev structure before releasing the netdev, so that delayed work handlers cannot access freed amt_dev after netdev release.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68152?
CVE-2026-68152 has a risk rating of 48, indicating a significant potential impact.
What type of vulnerability is CVE-2026-68152?
CVE-2026-68152 is categorized as a use-after-free vulnerability.
How does CVE-2026-68152 affect the Linux kernel?
CVE-2026-68152 can cause kernel crashes or memory corruption when accessing a freed amt_dev structure.
How do I fix CVE-2026-68152?
To mitigate CVE-2026-68152, ensure you have applied the latest updates and patches provided by the Linux kernel maintainers.
What should I do if my system is affected by CVE-2026-68152?
If your system is affected by CVE-2026-68152, update your Linux kernel to the latest version that includes the fix.