Executive brief
The Linux kernel's AMT (Automatic Multicast Tunneling) network driver failed to prevent devices from being set up across network namespaces, causing the system to hang when a lower device is unregistered. This prevents administrators from managing network infrastructure properly and can lead to system lockups requiring manual intervention to resolve.
Technical details
The vulnerability is a configuration validation flaw in the AMT driver (drivers/net/amt.c) where the amt_device_event() handler incorrectly attempts to unregister AMT devices created in a different network namespace (netns) when their lower device is removed. The root cause is that amt_lookup_upper_dev() only searches for upper devices within the lower device's namespace, missing cross-netns dependencies, and attempts to unregister only a single upper device rather than all affected devices. When the lower device is unregistered, this results in a deadlock where the system hangs waiting for the device to become free (ref count does not drop). The fix forbids cross-netns AMT setup entirely by rejecting such configurations at device creation time, preventing the problematic unregistration scenario. No authentication or special privileges beyond CAP_NET_ADMIN (required for netns operations) are needed to trigger this issue.
Affected products
- Linux Linux kernel 7.2.0-rc5 and earlier
Timeline
- 2026-09-17: disclosed