Linux Kernel up to 7.1.5/7.2-rc4 drop_monitor race condition

Summaryinfo

A vulnerability has been found in Linux Kernel up to 7.1.5/7.2-rc4 and classified as very critical. This issue affects the function net_dm_packet_trace_kfree_skb_hit/net_dm_hw_trap_packet_probe of the component drop_monitor. The manipulation leads to race condition. This vulnerability is uniquely identified as CVE-2026-68286. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.1.5/7.2-rc4. This issue affects the function net_dm_packet_trace_kfree_skb_hit/net_dm_hw_trap_packet_probe of the component drop_monitor. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: perform u64_stats updates under IRQ-disabled section In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were called after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local IRQs had already been re-enabled. Tracepoint probes can execute in IRQ or softirq context. On 32-bit architectures, u64_stats_update_begin() disables preemption but not interrupts, relying on seqcount writes. If a nested interrupt occurs on the same CPU during the 64-bit stats update, the reentrant seqcount update can corrupt the seqcount state or stats value. Fix this by performing the 64-bit per-CPU stats update before releasing drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain disabled during the u64_stats update.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-68286 since 07/30/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/10/2026).

Upgrading to version 7.1.6 or 7.2-rc5 eliminates this vulnerability. Applying the patch d5e2cd2bc8ae36617346b3a54ee9da61d866bf92/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.1.0
• 7.1.1
• 7.1.2
• 7.1.3
• 7.1.4
• 7.1.5
• 7.2-rc1
• 7.2-rc2
• 7.2-rc3
• 7.2-rc4

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion