CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD
In the Linux kernel, the following vulnerability has been resolved:
net: dropmonitor: fix info leak in NETDMATTRPAYLOAD
netdmpacketreportfill() and netdmhwpacketreportfill() open code the NETDMATTRPAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skbcopybits().
skbput() reserves nlatotalsize(payloadlen), i.e. the header plus the NLAALIGN() padding, but only payloadlen bytes are copied in. When payloadlen is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message.
KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned:
BUG: KMSAN: kernel-infoleak in copytoiter copytoiter skbdatagramiter skbcopydatagramiter netlinkrecvmsg sockrecvmsg sysrecvfrom Uninit was created at: kmemcacheallocnodenoprof allocskb netdmpacketwork Bytes 173-175 of 176 are uninitialized
Use nlareserve(), which sets up the attribute header and zeroes the padding, instead of open coding the attribute construction.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68288?
CVE-2026-68288 has been assigned a risk score of 17, indicating a high severity level.
How do I fix CVE-2026-68288?
To fix CVE-2026-68288, update your Linux kernel to the latest version where the vulnerability has been patched.
What kind of vulnerability is CVE-2026-68288?
CVE-2026-68288 is classified as an information leak vulnerability in the Linux kernel.
What components are affected by CVE-2026-68288?
CVE-2026-68288 affects the net subsystem of the Linux kernel, specifically the drop monitor features.
When was CVE-2026-68288 published?
CVE-2026-68288 was published on August 10, 2026.