A critical use-after-free vulnerability in the Linux kernel AMT subsystem poses a severe risk of remote code execution and system instability.

The vulnerability exists because several AMT receive and transmit paths cache skb header pointers and subsequently call helper functions that can reallocate the memory buffer. This leads to a use-after-free condition when the stale pointer is accessed again, which can be triggered by an unauthenticated remote attacker.

The potential for remote code execution (RCE) in the kernel layer represents the highest level of security risk. Successful exploitation could allow an attacker to gain full control over the affected system, bypass security controls, and access sensitive data. Given the CVSS score of 9.8, the impact on confidentiality, integrity, and availability is catastrophic, necessitating immediate patching.

Immediate Action: Update the Linux kernel to version 6.1.183, 6.6.148, 6.12.101, 6.18.42, or later, depending on your distribution branch.

Proactive Monitoring: Monitor system logs for kernel panics or unexpected crashes that may indicate exploitation attempts, and review network traffic patterns targeting AMT-related protocols.

Compensating Controls: If immediate patching is not possible, consider disabling the AMT (Auto Multicast Tunneling) module if it is not required for your network infrastructure.

Public Exploit Available: No

This is a critical vulnerability that directly affects the core kernel memory management logic. Administrators should prioritize testing and deploying the provided kernel patches across all affected environments as quickly as possible to prevent potential remote exploitation. Organizations that cannot immediately update should assess the necessity of the AMT module and disable it as a temporary measure to eliminate the attack surface.