The Linux kernel’s AMT subsystem caches pointer references to packet headers before calling helper functions that may reallocate the socket buffer head, causing the cached pointers to become invalid. The root weakness is the use of stale pointers after a pull operation, a classic instance of CWE‑825, which results in a use‑after‑free and potential kernel‑mode memory corruption. If an attacker can craft AMT packets that exploit these dangling references, they could trigger arbitrary code execution in kernel space.

All Linux kernel distributions that compile the AMT module (amt, amt_rcv, amt_dev_xmit, amt_multicast_data_handler, amt_membership_query_handler, amt_igmpv3_report_handler, amt_mldv2_report_handler, amt_update_handler) are affected. No specific kernel release series is listed, so any stock kernel build without the upstream fix is vulnerable.

The EPSS score of <1% indicates a very low probability of exploitation. The CVSS score of 9.8 indicates critical severity. The vulnerability is not listed in CISA KEV and no public exploits are documented. Exploitation requires network access to send crafted AMT packets over the protocols handled by the AMT module. The impact can range from memory corruption to privilege escalation via kernel‑mode code execution if the attacker controls packet contents.