CVE-2026-68286: drop_monitor: perform u64_stats updates under IRQ-disabled section
In the Linux kernel, the following vulnerability has been resolved:
dropmonitor: perform u64stats updates under IRQ-disabled section
In netdmpackettracekfreeskbhit() and netdmhwtrappacketprobe(), u64statsupdatebegin() / u64statsinc() / u64statsupdateend() were called after spinunlockirqrestore(&...dropqueue.lock, flags), when local IRQs had already been re-enabled.
Tracepoint probes can execute in IRQ or softirq context. On 32-bit architectures, u64statsupdatebegin() disables preemption but not interrupts, relying on seqcount writes. If a nested interrupt occurs on the same CPU during the 64-bit stats update, the reentrant seqcount update can corrupt the seqcount state or stats value.
Fix this by performing the 64-bit per-CPU stats update before releasing dropqueue.lock via spinunlockirqrestore(), ensuring local interrupts remain disabled during the u64stats update.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68286?
CVE-2026-68286 has a risk rating of 27, indicating a moderate level of severity.
How do I fix CVE-2026-68286?
To address CVE-2026-68286, update to the latest patched version of the Linux kernel as provided by your distribution.
Which systems are affected by CVE-2026-68286?
CVE-2026-68286 affects the Linux kernel, particularly in functions related to drop monitoring.
What are the implications of CVE-2026-68286?
The implications of CVE-2026-68286 could include potential race conditions impacting system stability.
When was CVE-2026-68286 published?
CVE-2026-68286 was published on August 10, 2026.