CVE-2026-90232: amt: Don't support cross-netns setup.
In the Linux kernel, the following vulnerability has been resolved:
amt: Don't support cross-netns setup.
When a lower device is unregistered, amtdeviceevent() tries to unregister its upper AMT device, but it has two problems.
1. amtlookupupperdev() looks up an upper device in the lower device's netns only
2. amtdeviceevent() unregisters a single upper device only
If AMT device is created on a lower device in another netns, removing the lower device triggers the splat below and gets stuck until all upper devices are removed. [0]
The cross-netns setup seems unintentional considering 1. and the following points:
amtlinksetup() sets dev->netnsimmutable to true skbscrubpacket() is not called in the fast path iproute2 binary fails to find cross-netns lower device via link-netns: # ip -n ns1 link add amt0 link-netns ns2 type amt dev veth1 Cannot find device "veth1"
Instead of supporting it properly and preparing for per-netns netdev unreg, let's forbid cross-netns setup.
Note that the problem 2. needs a separate fix.
[0]: WARNING: net/core/dev.c:12518 at unregisternetdevicemanynotify+0x1cce/0x2250, CPU#48: ip/2031 Modules linked in: CPU: 48 UID: 0 PID: 2031 Comm: ip Not tainted 7.2.0-rc5+ #27 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014 RIP: 0010:unregisternetdevicemanynotify (net/core/dev.c:12518) Code: 89 ef e8 d5 52 ae fe e9 d0 f4 ff ff 48 8d 3d f9 3b 9c 02 48 c7 c6 c0 0b 63 84 ba ab 1f 00 00 67 48 0f b9 3a e9 65 ff ff ff 90 <0f> 0b 90 eb 81 48 8d 3d f6 3b 9c 02 48 c7 c6 c0 0b 63 84 ba e2 1f RSP: 0018:ffffc90004abf160 EFLAGS: 00010212 RAX: ffff888104d38260 RBX: ffff88800b0911b8 RCX: dffffc0000000000 RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff85b9f880 RBP: ffffc90004abf2d0 R08: ffffffff85b9f887 R09: 1ffffffff0b73f10 R10: dffffc0000000000 R11: fffffbfff0b73f11 R12: ffff88800b091d08 R13: ffff88800b091178 R14: dffffc0000000000 R15: ffff88800b091000 FS: 00007f555b86c600(0000) GS:ffff8881942a0000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000562107d489c0 CR3: 0000000109a40002 CR4: 0000000000372ef0 Call Trace: <TASK> rtnldellink (net/core/rtnetlink.c:3632 net/core/rtnetlink.c:3674) rtnetlinkrcvmsg (net/core/rtnetlink.c:7112) netlinkrcvskb (net/netlink/afnetlink.c:2556) netlinkunicast (net/netlink/afnetlink.c:1319) netlinksendmsg (net/netlink/afnetlink.c:1900) syssendmsg (net/socket.c:775) syssendmsg (net/socket.c:2738) dosyscall64 (arch/x86/entry/syscall64.c:63) entrySYSCALL64afterhwframe (arch/x86/entry/entry64.S:121) ... unregisternetdevice: waiting for veth0 to become free. Usage count = 7 reftracker: netdev@ffff88800d7496d8 has 3/3 users at netdevadjacentdevinsert (./include/linux/netdevice.h:4525 ./include/linux/netdevice.h:4554 net/core/dev.c:8791) netdevupperdevlink (net/core/dev.c:8879 net/core/dev.c:8963) netdevupperdevlink (net/core/dev.c:9009) amtnewlink (drivers/net/amt.c:3321)
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The issue applies to AMT devices created on a lower device that belongs to a different network namespace. The described failure occurs when that lower device is later unregistered.
What is the observable impact when the condition is triggered?
Removing the lower device can produce a netdevice-unregistration warning and leave the operation stuck until all upper AMT devices are removed. The event handler searches for an upper device only in the lower device's network namespace and unregisters only one upper device.
What can be done if the fix cannot be deployed immediately?
Avoid creating cross-network-namespace AMT setups, and remove upper AMT devices before unregistering their lower device. The resolution described forbids cross-network-namespace setup rather than supporting it.
Does this fix address every AMT upper-device cleanup issue?
No. The description states that unregistering only a single upper device is a separate problem requiring a separate fix.