The Linux amt driver contains a use‑after‑free condition in amt_dev_xmit(). An skb queued in a qdisc can outlive the tunnel it points to because the tunnel needs a raw pointer in skb->cb. When the tunnel expires and is freed, the subsequent dequeue attempts to dereference this stale pointer, corrupting kernel memory. An attacker who can trigger this timing window could cause a kernel panic or execute arbitrary code, affecting confidentiality, integrity and availability.

The flaw resides in the core amt networking subsystem of the Linux kernel and applies to all releases that have not applied the commit that removes the queueing path. Any host that loads the amt module and operates as an IGMP/MLD relay is potentially vulnerable, independent of vendor.

EPSS is less than 1% indicating a very low likelihood of exploitation. The CVSS score of 8.1 marks the vulnerability as high severity. Exploitation requires crafting IGMP/MLD traffic with a netem delay that exceeds the tunnel lifetime (approximately 135 seconds). A local or remote attacker could engineer this mode of operation, potentially leading to denial of service or arbitrary code execution. The vulnerability is listed outside CISA KEV and has no known public exploit frameworks.