CVE-2026-68287

HighCVSS 7.5/10Last modified Oct 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix size calculations for 64-bit attributes

net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP).

On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, nla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for 64-bit alignment.

However, net_dm_packet_report_size() and net_dm_hw_packet_report_size() used nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes.

This under-estimation of SKB size can lead to an skb_over_panic() when __nla_reserve() or skb_put() is subsequently called.

Fix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f, < 1275a4769c126405c6c63b6372daff120ac679a6; >= ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f, < 0da8f531336b28a59b23e5a67d40eaed15906201; >= ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f, < 6048ed2dfb33426c8aef32f8d225ea91c66813db; >= ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f, < 925669d4cfd47a9019ab29b40676215bab5dae35; >= ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f, < 4a9e30764e80693bcf875c776170edce20f94fe0; >= ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f, < 7089f7ab99c89f443c92d8fcc585e63f2727f0b3
LinuxLinux5.4

References

Timeline

Published
Aug 10, 2026
Last modified
Oct 19, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-68288In the Linux kernel, the following vulnerability has been resolved: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD net_dm_packet_CVE-2026-68289In the Linux kernel, the following vulnerability has been resolved: tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream() In CVE-2026-68296.3nesquena hermes-webui contains a trust-boundary failure vulnerability that allows authenticated attackers to set or change a session workspaCVE-2026-682907.8In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rds_tcp_CVE-2026-68291In the Linux kernel, the following vulnerability has been resolved: idpf: fix max_vport related crash on allocation error during init Set CVE-2026-68292In the Linux kernel, the following vulnerability has been resolved: ice: prevent tstamp ring allocation for non-PF VSI types The pf->txtimCVE-2026-682937.1In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix MCIA register buffer overflow on 32 dword reads The MCIACVE-2026-682948.8In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QCVE-2026-682957.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Zero-extend signed ALU32 div/mod results ALU32 operatiCVE-2026-68296In the Linux kernel, the following vulnerability has been resolved: net: gre: fix lltx regression for GRE tunnels with SEQ/CSUM Before comCVE-2026-682977.8In the Linux kernel, the following vulnerability has been resolved: tipc: fix u16 MTU truncation in media and bearer MTU validation Both TCVE-2026-682987.8In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: Fix SVM leak on resv obj alloc failure in xe_vm_create() Co
CVE-2026-68287: High severity, CVSS 7.5 | Vulnix