Junglewise Threat Intelligence

CVE-2026-90232: Linux kernel AMT cross-netns device setup denial of service

CVE-2026-90232 · Severity: info · Published 2026-09-17

Executive brief

The Linux kernel's AMT (Automatic Multicast Tunneling) network driver failed to prevent devices from being set up across network namespaces, causing the system to hang when a lower device is unregistered. This prevents administrators from managing network infrastructure properly and can lead to system lockups requiring manual intervention to resolve.

Technical details

The vulnerability is a configuration validation flaw in the AMT driver (drivers/net/amt.c) where the amt_device_event() handler incorrectly attempts to unregister AMT devices created in a different network namespace (netns) when their lower device is removed. The root cause is that amt_lookup_upper_dev() only searches for upper devices within the lower device's namespace, missing cross-netns dependencies, and attempts to unregister only a single upper device rather than all affected devices. When the lower device is unregistered, this results in a deadlock where the system hangs waiting for the device to become free (ref count does not drop). The fix forbids cross-netns AMT setup entirely by rejecting such configurations at device creation time, preventing the problematic unregistration scenario. No authentication or special privileges beyond CAP_NET_ADMIN (required for netns operations) are needed to trigger this issue.

Affected products

  • Linux Linux kernel 7.2.0-rc5 and earlier

Timeline

  • 2026-09-17: disclosed

Related threats