CVE-2026-98968: amt: send the relay's General Query directly from the receive path
In the Linux kernel, the following vulnerability has been resolved:
amt: send the relay's General Query directly from the receive path
An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb->cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for 135s, so a netem delay of 180s on the amt device outlives it; when the tunnel expires and is freed, the subsequent dequeue triggers a use-after-free in amtdevxmit().
BUG: KASAN: slab-use-after-free in amtdevxmit+0x2763/0x2e20 Call Trace: amtdevxmit+0x2763/0x2e20 [drivers/net/amt.c:1262] devhardstartxmit+0x22f/0x620 schdirectxmit+0x12e/0xac0 netemdequeue+0x333/0xc50 nettxaction+0x35c/0xa60
amtsendigmpgq() and amtsendmldgq() are only called from amtrequesthandler(), inside the rcureadlockbh() section of amtrcv(). amtrequesthandler() already has the tunnel the query is for: it found or created it inside that section. Queuing the query with devqueuexmit() only leads back into amtdevxmit(), which strips the Ethernet header and calls amtsendmembershipquery() for that tunnel.
Make that call directly from the two senders instead, the same way amtsendadvertisement() transmits from the receive path. The query never waits in a qdisc, the tunnel is only dereferenced inside the RCU section that found or created it, and nothing is stored in skb->cb, so no lookup or refcount is needed. Remove the query branch of amtdevxmit(), amtskbcb() and struct amtskbcb, which have no users left.
Behaviour changes: - The relay's own General Queries no longer pass through the amt device's egress path: its qdisc, tc egress (clsact/tcx), the netfilter egress hook and packet taps. They are still visible as UDP on the underlay. - A query that is sent successfully is no longer counted as txdropped. The old query branch left through the unlock label, which counted every sent query as dropped. - A query that reaches amtdevxmit() on a relay from elsewhere, such as a userspace querier, is now dropped at the IGMP/MLD type switch. Before, it trusted whatever skb->cb held, and a NULL tunnel hit the WARNON(1).