CVE-2026-68287 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
drop_monitor: fix size calculations for 64-bit attributes
net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP).
On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, nla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for 64-bit alignment.
However, net_dm_packet_report_size() and net_dm_hw_packet_report_size() used nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes.
This under-estimation of SKB size can lead to an skb_over_panic() when __nla_reserve() or skb_put() is subsequently called.
Fix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability resides in the Linux kernel's drop monitor implementation, specifically within the network debugging and monitoring subsystem that handles packet reporting. This issue affects systems where the kernel processes network packets through the drop monitor mechanism, which is designed to capture and report packet information for debugging purposes. The drop monitor functionality operates by creating structured data reports containing packet attributes such as packet counters and timestamps, which are essential for network administrators and security analysts to diagnose network issues and monitor traffic patterns.
The technical flaw manifests in the calculation of attribute sizes when processing 64-bit data types on 32-bit architectures lacking efficient unaligned access capabilities. The functions net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() utilize nla_put_u64_64bit() to append 64-bit attributes representing packet counters and timestamps to Netlink messages. However, the corresponding size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() incorrectly use nla_total_size(sizeof(u64)) instead of the appropriate nla_total_size_64bit(sizeof(u64)). This discrepancy becomes critical on 32-bit systems without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, where the kernel's Netlink attribute handling mechanism inserts a 4-byte padding attribute (NET_DM_ATTR_PAD) to maintain proper 64-bit alignment requirements.
The operational impact of this vulnerability represents a potential denial-of-service condition that can compromise system stability and availability. When the under-estimated SKB (socket buffer) size leads to insufficient memory allocation for the packet report data structure, subsequent calls to __nla_reserve() or skb_put() functions trigger an skb_over_panic() error condition. This panic occurs because the kernel attempts to write beyond the allocated buffer boundaries, resulting in system crashes or kernel oops messages that can render network monitoring functionality completely non-operational. The vulnerability is particularly concerning in production environments where continuous network monitoring is critical for security operations and system reliability.
The fix addresses this issue by correctly implementing nla_total_size_64bit(sizeof(u64)) in both size calculation functions, ensuring proper buffer allocation accounting for potential padding requirements on 32-bit architectures. This change aligns the size estimation with the actual memory consumption patterns of the Netlink attribute handling system, preventing buffer overflows and maintaining system stability during packet monitoring operations. The solution follows established kernel coding practices and security principles that emphasize proper resource management and buffer boundary checking, which are fundamental requirements in secure systems development. This vulnerability classification maps to CWE-129, representing improper validation of array index bounds, and aligns with ATT&CK technique T1489, which covers denial of service through resource exhaustion or system instability.
The remediation approach demonstrates the importance of careful attention to architecture-specific memory alignment requirements in kernel development, where assumptions about data layout and memory consumption can lead to critical security vulnerabilities. This fix exemplifies how seemingly minor calculation errors in low-level kernel code can have significant operational consequences, particularly in network infrastructure systems where reliability and availability are paramount. The resolution ensures that network monitoring capabilities remain functional across all supported architectures while maintaining the integrity of packet reporting mechanisms essential for security analysis and network troubleshooting operations.