High 7.8Published Aug 10, 2026

CVE-2026-68152amt: fix use-after-free in AMT delayed works

Updated under an hour ago (2026-10-19 06:10 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: amt: fix use-after-free in AMT delayed works When an AMT device is removed, pending delayed works can still access the freed amt_dev structure, which may result in kernel crashes or memory corruption. amt_dev_stop() cancels req_wq and discovery_wq with cancel_delayed_work_sync(), but these works can be scheduled again from event_wq after the cancellation. This allows delayed works to access the freed amt_dev structure after the netdev has been released. The following is a simple race scenario: CPU0 CPU1 amt_dev_stop() cancel_delayed_work_sync() amt_event_work() mod_delayed_work(req_wq) free netdev req_wq accesses freed amt_dev Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and discovery_wq from being queued again and wait for running work items to complete. The delayed works are disabled after initialization in amt_newlink() and enabled only when the device is successfully opened. This keeps the delayed work lifecycle synchronized with the lifetime of the AMT device.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from cbc21dc1cfe949e37b2a54c71511579f1899e8d4 before a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2; from cbc21dc1cfe949e37b2a54c71511579f1899e8d4 before 1a644db2cf59f164cdf3c75995bab5aadc097528; from cbc21dc1cfe949e37b2a54c71511579f1899e8d4 before 006340cf06881b6ff49767d8b6f3c4f7b892670c; from cbc21dc1cfe949e37b2a54c71511579f1899e8d4 before ea20c44935d6142daecfa9b39d635033a7553e1b	CNA record

References

https://git.kernel.org/stable/c/a46bfa01e01df0f6f6dc4b0be18db002d6d2dbd2
https://git.kernel.org/stable/c/1a644db2cf59f164cdf3c75995bab5aadc097528
https://git.kernel.org/stable/c/006340cf06881b6ff49767d8b6f3c4f7b892670c
https://git.kernel.org/stable/c/ea20c44935d6142daecfa9b39d635033a7553e1b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.