{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68287","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.380Z","datePublished":"2026-08-10T12:02:20.110Z","dateUpdated":"2026-10-03T10:55:42.919Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-10-03T10:55:42.919Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix size calculations for 64-bit attributes\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use\nnla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and\nNET_DM_ATTR_TIMESTAMP).\n\nOn 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS,\nnla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for\n64-bit alignment.\n\nHowever, net_dm_packet_report_size() and net_dm_hw_packet_report_size()\nused nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)),\nbudgeting 12 bytes instead of up to 16 bytes.\n\nThis under-estimation of SKB size can lead to an skb_over_panic() when\n__nla_reserve() or skb_put() is subsequently called.\n\nFix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - The report path runs in net/core/drop_monitor.c whenever a received packet is dropped or hardware-trapped; a remote unauthenticated attacker triggers it simply by sending packets that get dropped, and controls skb->len which feeds payload_len and thus the under-sized allocation.\nAC:L - On an affected build the attacker can drive the path at will, tuning packet length byte-by-byte to land the under-budgeted skb exactly at an allocator bucket boundary; no race or unpredictable state is involved.\nPR:N - Enabling packet-alert mode is the victim administrator's monitoring configuration; the attacker's own action is only sending packets that get dropped, which needs no account, credentials or privileges on the target.\nUI:N - The drop-report path is executed automatically by the kernel workqueue when packets are dropped; no local user action is needed.\nS:U - The under-allocated skb and the resulting skb_over_panic() are entirely within the kernel's own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - __nla_reserve() detects the overrun in skb_put() and panics before any data is written or read past the buffer, so no memory contents are disclosed to the attacker.\nI:N - skb_over_panic() aborts before the out-of-bounds payload copy occurs, so no adjacent memory is modified and no control-flow primitive is obtained.\nA:H - The size under-estimation makes skb_put() exceed skb->end, invoking skb_over_panic() which calls BUG() and takes down the machine, a complete and repeatable denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/drop_monitor.c"],"versions":[{"version":"ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f","lessThan":"1275a4769c126405c6c63b6372daff120ac679a6","status":"affected","versionType":"git"},{"version":"ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f","lessThan":"0da8f531336b28a59b23e5a67d40eaed15906201","status":"affected","versionType":"git"},{"version":"ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f","lessThan":"6048ed2dfb33426c8aef32f8d225ea91c66813db","status":"affected","versionType":"git"},{"version":"ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f","lessThan":"925669d4cfd47a9019ab29b40676215bab5dae35","status":"affected","versionType":"git"},{"version":"ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f","lessThan":"4a9e30764e80693bcf875c776170edce20f94fe0","status":"affected","versionType":"git"},{"version":"ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f","lessThan":"7089f7ab99c89f443c92d8fcc585e63f2727f0b3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/drop_monitor.c"],"versions":[{"version":"5.4","status":"affected"},{"version":"0","lessThan":"5.4","status":"unaffected","versionType":"semver"},{"version":"6.1.189","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.158","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.111","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/1275a4769c126405c6c63b6372daff120ac679a6"},{"url":"https://git.kernel.org/stable/c/0da8f531336b28a59b23e5a67d40eaed15906201"},{"url":"https://git.kernel.org/stable/c/6048ed2dfb33426c8aef32f8d225ea91c66813db"},{"url":"https://git.kernel.org/stable/c/925669d4cfd47a9019ab29b40676215bab5dae35"},{"url":"https://git.kernel.org/stable/c/4a9e30764e80693bcf875c776170edce20f94fe0"},{"url":"https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"}],"title":"drop_monitor: fix size calculations for 64-bit attributes","x_generator":{"engine":"bippy-1.2.0"}}}}