CVE-2026-68152

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> amt: fix use-after-free in AMT delayed works<br /> <br /> When an AMT device is removed, pending delayed works can still access<br /> the freed amt_dev structure, which may result in kernel crashes or<br /> memory corruption.<br /> <br /> amt_dev_stop() cancels req_wq and discovery_wq with<br /> cancel_delayed_work_sync(), but these works can be scheduled again<br /> from event_wq after the cancellation. This allows delayed works to<br /> access the freed amt_dev structure after the netdev has been released.<br /> <br /> The following is a simple race scenario:<br /> <br /> CPU0 CPU1<br /> <br /> amt_dev_stop()<br /> cancel_delayed_work_sync()<br /> amt_event_work()<br /> mod_delayed_work(req_wq)<br /> free netdev<br /> req_wq accesses freed amt_dev<br /> <br /> Use disable_delayed_work_sync() in amt_dev_stop() to prevent req_wq and<br /> discovery_wq from being queued again and wait for running work items<br /> to complete.<br /> <br /> The delayed works are disabled after initialization in<br /> amt_newlink() and enabled only when the device is successfully opened.<br /> This keeps the delayed work lifecycle synchronized with the lifetime<br /> of the AMT device.