CVE-2026-98419

Received Received - Intake

Out-of-Bounds Write in Linux Kernel drop_monitor

Publication date: 2026-10-14

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr); skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al); Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info. Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98419

EUVD

EUVD-2026-101068

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	683703a26e4677db437a1480682851e27c7a154f
Linux	Linux	2.6.31

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where an out-of-bounds write occurs in the reset_per_cpu_data() function. The issue arises because the allocated buffer size includes an extra attribute header but the memset operation writes beyond the intended buffer, corrupting adjacent memory in the skb structure.

Detection Guidance

This vulnerability is specific to the Linux kernel's drop_monitor component and involves an out-of-bounds write in reset_per_cpu_data(). Detection requires checking kernel logs for related errors or crashes, particularly during network drop monitoring operations. No direct commands are provided in the context, but monitoring for kernel oops or warnings related to net_dm_alert_msg or skb_shared_info corruption may indicate exploitation.

Impact Analysis

This vulnerability could lead to kernel memory corruption, potentially causing system crashes, privilege escalation, or other unpredictable behavior. Systems using vulnerable Linux kernel versions may experience instability or security breaches.

Compliance Impact

This vulnerability involves an out-of-bounds write in the Linux kernel's drop_monitor component, which could lead to memory corruption and potential denial-of-service conditions. While it does not directly impact data privacy or security controls, such kernel vulnerabilities may affect compliance by compromising system integrity and availability, which are key requirements under standards like GDPR (availability of processing systems) and HIPAA (security and integrity of electronic protected health information).

Mitigation Strategies

Apply the kernel patch that fixes the out-of-bounds write in reset_per_cpu_data(). Update to a Linux kernel version that includes the fix. If immediate patching is not possible, disable the drop_monitor feature by setting the kernel parameter net.core.netdev_drops to 0 or unloading the drop_monitor module if loaded.

Hi! I’m here to help you understand CVE-2026-98419. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70