CVE-2026-68288 in Linux
Summary
by MITRE • 08/10/2026
In the Linux kernel, the following vulnerability has been resolved:
net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skb_copy_bits().
skb_put() reserves nla_total_size(payload_len), i.e. the header plus the NLA_ALIGN() padding, but only payload_len bytes are copied in. When payload_len is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message.
KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned:
BUG: KMSAN: kernel-infoleak in _copy_to_iter _copy_to_iter __skb_datagram_iter skb_copy_datagram_iter netlink_recvmsg sock_recvmsg __sys_recvfrom Uninit was created at: kmem_cache_alloc_node_noprof __alloc_skb net_dm_packet_work Bytes 173-175 of 176 are uninitialized
Use __nla_reserve(), which sets up the attribute header and zeroes the padding, instead of open coding the attribute construction.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability exists within the Linux kernel's networking subsystem specifically in the net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() functions where improper handling of the NET_DM_ATTR_PAYLOAD attribute creates an information disclosure risk. The flaw stems from the use of direct memory operations without proper initialization of padding bytes, leading to leakage of uninitialized kernel memory to user space through netlink messages.
The technical implementation error occurs when these functions utilize open coding for attribute construction rather than employing the proper kernel infrastructure. When skb_put() reserves memory using nla_total_size(payload_len), it allocates space for both the header and NLA_ALIGN() padding, but only payload_len bytes are populated through skb_copy_bits() operations. This creates a scenario where 1-3 padding bytes remain uninitialized when payload_len is not divisible by four, resulting in kernel memory contents being inadvertently exposed.
The operational impact of this vulnerability manifests as an information disclosure attack vector that can be exploited by unprivileged users to obtain sensitive kernel memory data through netlink communication channels. The KMSAN analysis confirms the issue occurs particularly in software packet processing paths where payload lengths are not 4-byte aligned, with specific examples showing uninitialized bytes 173-175 of 176 being leaked. This represents a classic information leak vulnerability that can potentially expose kernel stack contents, memory management structures, or other sensitive data.
The mitigation approach requires replacing the open-coded attribute construction with __nla_reserve() function calls, which properly initialize both the attribute header and padding bytes to zero before data insertion. This aligns with established security practices and follows the principle of least privilege by preventing unintended data exposure through kernel interfaces. The fix directly addresses the root cause by ensuring proper memory initialization in accordance with netlink message formatting standards and reduces the attack surface for potential information disclosure threats.
This vulnerability maps to CWE-248, Uncontrolled Format String, and CWE-125, Out-of-bounds Read, while also aligning with ATT&CK technique T1005 for Data from Local System and T1059 for Command and Scripting Interpreter. The issue demonstrates how seemingly minor memory handling oversights can create significant security implications in kernel space operations where user-space processes interact with kernel data structures through well-defined interfaces like netlink sockets.