CVE-2026-68287: drop_monitor: fix size calculations for 64-bit attributes
In the Linux kernel, the following vulnerability has been resolved:
dropmonitor: fix size calculations for 64-bit attributes
netdmpacketreportfill() and netdmhwpacketreportfill() use nlaputu6464bit() to append 64-bit attributes (NETDMATTRPC and NETDMATTRTIMESTAMP).
On 32-bit architectures without CONFIGHAVEEFFICIENTUNALIGNEDACCESS, nlaputu6464bit() may append a 4-byte NETDMATTRPAD attribute for 64-bit alignment.
However, netdmpacketreportsize() and netdmhwpacketreportsize() used nlatotalsize(sizeof(u64)) instead of nlatotalsize64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes.
This under-estimation of SKB size can lead to an skboverpanic() when nlareserve() or skbput() is subsequently called.
Fix this by using nlatotalsize64bit(sizeof(u64)) in both size calculations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the drop_monitor implementation so both size calculations use nla_total_size_64bit(sizeof(u64)) instead of nla_total_size(sizeof(u64)) for 64-bit attributes, preventing SKB under-estimation on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS.
Linux kernel drop_monitor: fix size calculations for 64-bit attributes (use nla_total_size_64bit for u64) = apply patch - Configuration
In net_dm_packet_report_size(), net_dm_hw_packet_report_size(), net_dm_packet_report_fill(), and net_dm_hw_packet_report_fill(), adjust size/space budgeting for 64-bit attributes so calls that reserve/append space account for possible NET_DM_ATTR_PAD appended by nla_put_u64_64bit() (e.g., for NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP), avoiding skb_over_panic().
Linux kernel (functions mentioned: net_dm_packet_report_size/net_dm_hw_packet_report_size/net_dm_packet_report_fill/net_dm_hw_packet_report_fill) nla_total_size vs nla_total_size_64bit for u64 attribute sizing = use nla_total_size_64bit(sizeof(u64))
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68287?
CVE-2026-68287 has a risk score of 34.
How do I fix CVE-2026-68287?
To fix CVE-2026-68287, update the Linux kernel to a version that includes the security patches addressing this vulnerability.
What impact does CVE-2026-68287 have on system security?
CVE-2026-68287 can potentially lead to improper handling of 64-bit attributes, which may cause system instability or data corruption.
Which components are affected by CVE-2026-68287?
CVE-2026-68287 affects the drop_monitor functionality in the Linux kernel related to 64-bit attribute size calculations.
When was CVE-2026-68287 published?
CVE-2026-68287 was published on August 10, 2026.