CVE-2026-68287
Received Received - Intake

Linux Kernel SKB Over-Panic in Drop Monitor

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix size calculations for 64-bit attributes net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP). On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, nla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for 64-bit alignment. However, net_dm_packet_report_size() and net_dm_hw_packet_report_size() used nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes. This under-estimation of SKB size can lead to an skb_over_panic() when __nla_reserve() or skb_put() is subsequently called. Fix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-68287
EUVD
EUVD-2026-55388

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect size calculations for 64-bit attributes in the drop_monitor component. Functions net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use nla_put_u64_64bit() to add 64-bit attributes, which may require padding on 32-bit architectures without efficient unaligned access. However, size calculations in net_dm_packet_report_size() and net_dm_hw_packet_report_size() underestimate the required space, leading to potential skb_over_panic() errors when the kernel tries to reserve or add data to the socket buffer.

Detection Guidance

This vulnerability is specific to the Linux kernel's drop_monitor functionality and may lead to kernel panics (skb_over_panic) due to incorrect SKB size calculations. Detection requires checking kernel logs for skb_over_panic errors or crashes related to net_dm_packet_report_fill or net_dm_hw_packet_report_fill functions.

Impact Analysis

This vulnerability can cause system crashes due to skb_over_panic() errors, which occur when the kernel buffer handling fails. Systems running affected Linux kernel versions may experience kernel panics or instability, potentially leading to denial of service conditions. It primarily affects 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS enabled.

Mitigation Strategies

Apply the kernel patch that replaces nla_total_size(sizeof(u64)) with nla_total_size_64bit(sizeof(u64)) in net_dm_packet_report_size() and net_dm_hw_packet_report_size(). Recompile and reboot the system with the updated kernel.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-68287. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart