In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued… (CVE-2026-98968)

The vulnerability in the Linux kernel AMT relay occurs because an skb queued in a qdisc can outlive the tunnel it references via a raw pointer in skb->cb. Specifically, with igmp_qrv set to 1, a tunnel can live for 135 seconds, but a netem delay of 180 seconds on the AMT device can cause the tunnel to expire and be freed before the skb is dequeued, triggering a use-after-free in amt_dev_xmit(). The fix involves sending the relay's General Query directly from the receive path within the RCU read lock section, avoiding queuing the skb and dereferencing the tunnel only while it is guaranteed valid. This removes the query branch in amt_dev_xmit() and associated skb control block structures, preventing the use-after-free and related kernel bugs.

The vulnerability can cause a kernel use-after-free condition leading to potential kernel crashes or instability when processing AMT relay General Queries. It may trigger kernel warnings and bugsanalyzer reports (KASAN slab-use-after-free). There is no indication of remote code execution or privilege escalation from the provided data.

A fix is available and has been applied in the Linux kernel to send the relay's General Query directly from the receive path, avoiding queuing and use-after-free conditions. Users should update to the fixed Linux kernel version containing this patch. No additional mitigation actions are required as the vulnerability is addressed by the official fix.