{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98968 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-98968 is a high-severity vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98968 and fix it if it is affected.\n\nWhat it is: CVE-2026-98968 is a high-severity vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98968 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98968/ (Markdown: https://insights.sbomify.com/CVE-2026-98968/index.md)","id":"CVE-2026-98968","markdown":"https://insights.sbomify.com/CVE-2026-98968/index.md","name":"CVE-2026-98968","record":{"aliases":["AZL-110786","BELL-CVE-2026-98968","DEBIAN-CVE-2026-98968","GHSA-phwh-mpfm-5g26","UBUNTU-CVE-2026-98968"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\namt: send the relay's General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb-\u003ecb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n  BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n  Call Trace:\n   amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n   dev_hard_start_xmit+0x22f/0x620\n   sch_direct_xmit+0x12e/0xac0\n   netem_dequeue+0x333/0xc50\n   net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb-\u003ecb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay's own General Queries no longer pass through the amt\n   device's egress path: its qdisc, tc egress (clsact/tcx), the\n   netfilter egress hook and packet taps. They are still visible as\n   UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n   tx_dropped. The old query branch left through the unlock label,\n   which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n   such as a userspace querier, is now dropped at the IGMP/MLD type\n   switch. Before, it trusted whatever skb-\u003ecb held, and a NULL\n   tunnel hit the WARN_ON(1).","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"amt: send the relay's General Query directly from the receive path","id":"CVE-2026-98968","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"net/sched: em_text: reject unterminated algo before autoload","id":"CVE-2026-98969"},"packages":[],"prev":{"headline":"cxgb4/ch_ktls: disable softirqs around tid_list erases","id":"CVE-2026-98967"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-24","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-98968/"}