Kernel-level use-after-free in a widely deployed Linux network driver; can crash or be abused for kernel compromise—impacting servers, network appliances and many distros.
CVE-2026-98968
Use-after-free in Linux amt network driver allowing kernel crash or possible RCE.
Is CVE-2026-98968 being exploited?
Not confirmed. CVE-2026-98968 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked. EPSS currently estimates a 0.50% probability of exploitation in the next 30 days.
How severe is CVE-2026-98968?
CVE-2026-98968 is rated High with a CVSS score of 8.1. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-98968?
Yes. A fix has been recorded for CVE-2026-98968. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-98968 affect?
CVE-2026-98968 affects Linux kernel (drivers/net/amt.c), Systems using amt relay/AMT network feature, Linux distributions shipping affected kernels. Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-98968?
Apply kernel stable updates/backports that include the amt fixes and reboot affected hosts.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Network-triggerable kernel use-after-free causing system crash (DoS) and potential remote kernel code execution/privilege escalation.
Patch when possible
- affected>= cbc21dc1cfe949e37b2a54c71511579f1899e8d4 and < 95114e421196250e3d9662f12df442799477d3c3
- affected>= cbc21dc1cfe949e37b2a54c71511579f1899e8d4 and < e7183b7d518ce8b3e1f7284f9881d7a87569df14
- affected>= cbc21dc1cfe949e37b2a54c71511579f1899e8d4 and < 181cb48c1e9af6b402567e132f879f89d1c54131
- affected>= cbc21dc1cfe949e37b2a54c71511579f1899e8d4 and < e7ea63b4195a150604993044ab574d8240f2a399
- affected>= cbc21dc1cfe949e37b2a54c71511579f1899e8d4 and < afae89de73dd693cfa329580ba0fba63bd3f0a11
- affected5.16
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.