CVE-2026-68287 (GCVE-0-2026-68287)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:02 – Updated: 2026-09-21 13:13
VLAI
Title
drop_monitor: fix size calculations for 64-bit attributes
Summary
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP). On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, nla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for 64-bit alignment. However, net_dm_packet_report_size() and net_dm_hw_packet_report_size() used nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes. This under-estimation of SKB size can lead to an skb_over_panic() when __nla_reserve() or skb_put() is subsequently called. Fix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f , < 6048ed2dfb33426c8aef32f8d225ea91c66813db (git)
Affected: ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f , < 925669d4cfd47a9019ab29b40676215bab5dae35 (git)
Affected: ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f , < 4a9e30764e80693bcf875c776170edce20f94fe0 (git)
Affected: ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f , < 7089f7ab99c89f443c92d8fcc585e63f2727f0b3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.4
Unaffected: 0 , < 5.4 (semver)
Unaffected: 6.12.111 , ≤ 6.12.* (semver)
Unaffected: 6.18.53 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6048ed2dfb33426c8aef32f8d225ea91c66813db",
              "status": "affected",
              "version": "ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f",
              "versionType": "git"
            },
            {
              "lessThan": "925669d4cfd47a9019ab29b40676215bab5dae35",
              "status": "affected",
              "version": "ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f",
              "versionType": "git"
            },
            {
              "lessThan": "4a9e30764e80693bcf875c776170edce20f94fe0",
              "status": "affected",
              "version": "ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f",
              "versionType": "git"
            },
            {
              "lessThan": "7089f7ab99c89f443c92d8fcc585e63f2727f0b3",
              "status": "affected",
              "version": "ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.4"
            },
            {
              "lessThan": "5.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix size calculations for 64-bit attributes\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use\nnla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and\nNET_DM_ATTR_TIMESTAMP).\n\nOn 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS,\nnla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for\n64-bit alignment.\n\nHowever, net_dm_packet_report_size() and net_dm_hw_packet_report_size()\nused nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)),\nbudgeting 12 bytes instead of up to 16 bytes.\n\nThis under-estimation of SKB size can lead to an skb_over_panic() when\n__nla_reserve() or skb_put() is subsequently called.\n\nFix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The report path runs in net/core/drop_monitor.c whenever a received packet is dropped or hardware-trapped; a remote unauthenticated attacker triggers it simply by sending packets that get dropped, and controls skb-\u003elen which feeds payload_len and thus the under-sized allocation.\nAC:L - On an affected build the attacker can drive the path at will, tuning packet length byte-by-byte to land the under-budgeted skb exactly at an allocator bucket boundary; no race or unpredictable state is involved.\nPR:N - Enabling packet-alert mode is the victim administrator\u0027s monitoring configuration; the attacker\u0027s own action is only sending packets that get dropped, which needs no account, credentials or privileges on the target.\nUI:N - The drop-report path is executed automatically by the kernel workqueue when packets are dropped; no local user action is needed.\nS:U - The under-allocated skb and the resulting skb_over_panic() are entirely within the kernel\u0027s own security authority; no VM, IOMMU or sandbox boundary is crossed.\nC:N - __nla_reserve() detects the overrun in skb_put() and panics before any data is written or read past the buffer, so no memory contents are disclosed to the attacker.\nI:N - skb_over_panic() aborts before the out-of-bounds payload copy occurs, so no adjacent memory is modified and no control-flow primitive is obtained.\nA:H - The size under-estimation makes skb_put() exceed skb-\u003eend, invoking skb_over_panic() which calls BUG() and takes down the machine, a complete and repeatable denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T13:13:38.084Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6048ed2dfb33426c8aef32f8d225ea91c66813db"
        },
        {
          "url": "https://git.kernel.org/stable/c/925669d4cfd47a9019ab29b40676215bab5dae35"
        },
        {
          "url": "https://git.kernel.org/stable/c/4a9e30764e80693bcf875c776170edce20f94fe0"
        },
        {
          "url": "https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"
        }
      ],
      "title": "drop_monitor: fix size calculations for 64-bit attributes",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68287",
    "datePublished": "2026-08-10T12:02:20.110Z",
    "dateReserved": "2026-07-30T09:28:09.380Z",
    "dateUpdated": "2026-09-21T13:13:38.084Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68287",
      "date": "2026-09-20",
      "epss": "0.00488",
      "percentile": "0.41064"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/drop_monitor.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "4a9e30764e80693bcf875c776170edce20f94fe0",
                    "status": "affected",
                    "version": "ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "7089f7ab99c89f443c92d8fcc585e63f2727f0b3",
                    "status": "affected",
                    "version": "ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/drop_monitor.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "5.4"
                  },
                  {
                    "lessThan": "5.4",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix size calculations for 64-bit attributes\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use\nnla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and\nNET_DM_ATTR_TIMESTAMP).\n\nOn 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS,\nnla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for\n64-bit alignment.\n\nHowever, net_dm_packet_report_size() and net_dm_hw_packet_report_size()\nused nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)),\nbudgeting 12 bytes instead of up to 16 bytes.\n\nThis under-estimation of SKB size can lead to an skb_over_panic() when\n__nla_reserve() or skb_put() is subsequently called.\n\nFix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations."
          }
        ],
        "id": "CVE-2026-68287",
        "lastModified": "2026-08-17T05:18:31.367",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:20:18.010",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4a9e30764e80693bcf875c776170edce20f94fe0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/7089f7ab99c89f443c92d8fcc585e63f2727f0b3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:21:06+00:00",
      "cve": "CVE-2026-68287",
      "id": "CVE-2026-68287",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "233",
      "product_status:known_not_affected": "44",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drop_monitor: fix size calculations for 64-bit attributes",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68287.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:37:06Z",
      "cve": "CVE-2026-68287",
      "id": "CVE-2026-68287",
      "initial_release_date": "2026-08-22T00:54:53Z",
      "product_status:known_affected": "277",
      "product_status:known_not_affected": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68287",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68287.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.