CVE-2026-68288

Status: UPDATED  |  Advisory ID: CVE-2026-68288

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code

the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload

before overwriting it with skb_copy_bits().

skb_put() reserves nla_total_size(payload_len), i.e. the header plus the

NLA_ALIGN() padding, but only payload_len bytes are copied in. When

payload_len is not a multiple of 4 the 1-3 padding bytes are never

initialized and are leaked to user space inside the netlink message.

KMSAN confirms the leak for the software path when the packet payload

length is not 4-byte aligned:

BUG: KMSAN: kernel-infoleak in _copy_to_iter

_copy_to_iter

__skb_datagram_iter

skb_copy_datagram_iter

netlink_recvmsg

sock_recvmsg

__sys_recvfrom

Uninit was created at:

kmem_cache_alloc_node_noprof

__alloc_skb

net_dm_packet_work

Bytes 173-175 of 176 are uninitialized

Use __nla_reserve(), which sets up the attribute header and zeroes the

padding, instead of open coding the attribute construction. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References