https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 13:03:08 +0000 https://vulnerability.circl.lu/vuln/cve-2026-68302 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>amt: re-read skb header pointers after every pull</p> <p>Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header) and then call a helper that can reallocate that head before the cached pointer is used again. pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and ipv6_mc_check_mld() can all free the old head and move the data, so a pointer taken before the call dangles afterwards and the later access is a use-after-free of the freed head.</p> <p>The affected sites are:</p> <p>amt_rcv() caches ip_hdr() before amt_parse_type() pulls, then reads iph-&gt;saddr.</p> <p>amt_dev_xmit() caches ip_hdr()/ipv6_hdr() before ip_mc_check_igmp()/ ipv6_mc_check_mld() and pskb_may_pull(), then reads the group address.</p> <p>amt_multicast_data_handler() caches eth_hdr() before pskb_may_pull(), then writes the L2 header.</p> <p>amt_membership_query_handler() caches the AMT header, the outer and inner eth_hdr() and ip_hdr() before iptunnel_pull_header() and several pulls, then reads and writes them.</p> <p>amt_igmpv3_report_handler() and amt_mldv2_report_handler() cache ip_hdr()/ipv6_hdr() and the current group record and read the record count from the report header inside the record loop, across the *_mc_may_pull() calls.</p> <p>amt_update_handler() caches ip_hdr() and the AMT membership-update header before pskb_may_pull(),…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>amt: re-read skb header pointers after every pull</p> <p>Several AMT receive and transmit paths cache a pointer into the skb head (ip_hdr(), ipv6_hdr(), eth_hdr() or the AMT message header) and then call a helper that can reallocate that head before the cached pointer is used again. pskb_may_pull(), ip_mc_may_pull(), ipv6_mc_may_pull(), iptunnel_pull_header(), ip_mc_check_igmp() and ipv6_mc_check_mld() can all free the old head and move the data, so a pointer taken before the call dangles afterwards and the later access is a use-after-free of the freed head.</p> <p>The affected sites are:</p> <p>amt_rcv() caches ip_hdr() before amt_parse_type() pulls, then reads iph-&gt;saddr.</p> <p>amt_dev_xmit() caches ip_hdr()/ipv6_hdr() before ip_mc_check_igmp()/ ipv6_mc_check_mld() and pskb_may_pull(), then reads the group address.</p> <p>amt_multicast_data_handler() caches eth_hdr() before pskb_may_pull(), then writes the L2 header.</p> <p>amt_membership_query_handler() caches the AMT header, the outer and inner eth_hdr() and ip_hdr() before iptunnel_pull_header() and several pulls, then reads and writes them.</p> <p>amt_igmpv3_report_handler() and amt_mldv2_report_handler() cache ip_hdr()/ipv6_hdr() and the current group record and read the record count from the report header inside the record loop, across the *_mc_may_pull() calls.</p> <p>amt_update_handler() caches ip_hdr() and the AMT membership-update header before pskb_may_pull(),…</p> https://vulnerability.circl.lu/vuln/cve-2026-68302