CVE-2026-68288

Received Received - Intake

Kernel Information Leak in Linux Kernel Netlink

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skb_copy_bits(). skb_put() reserves nla_total_size(payload_len), i.e. the header plus the NLA_ALIGN() padding, but only payload_len bytes are copied in. When payload_len is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message. KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned: BUG: KMSAN: kernel-infoleak in _copy_to_iter _copy_to_iter __skb_datagram_iter skb_copy_datagram_iter netlink_recvmsg sock_recvmsg __sys_recvfrom Uninit was created at: kmem_cache_alloc_node_noprof __alloc_skb net_dm_packet_work Bytes 173-175 of 176 are uninitialized Use __nla_reserve(), which sets up the attribute header and zeroes the padding, instead of open coding the attribute construction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68288

EUVD

EUVD-2026-55389

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is an information leak in the Linux kernel's drop_monitor feature. It occurs when packet payloads are processed for netlink messages. The issue arises because padding bytes in the payload are not initialized before being sent to userspace, potentially exposing uninitialized memory.

Detection Guidance

This vulnerability involves an information leak in the Linux kernel's net: drop_monitor module. Detection requires kernel-level inspection for uninitialized memory exposure in NET_DM_ATTR_PAYLOAD attributes. No direct commands are provided in the context, but monitoring for kernel warnings or using KMSAN (Kernel Memory Sanitizer) could help identify such leaks.

Impact Analysis

An attacker with local access could exploit this to read sensitive kernel memory, leading to potential data leaks or privilege escalation. Systems processing network packets may be at higher risk.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating confidentiality requirements in GDPR and HIPAA. Organizations must address it to maintain compliance with data protection standards.

Mitigation Strategies

Apply the Linux kernel patch that replaces open-coded attribute construction with __nla_reserve() to zero padding bytes. Update to a kernel version containing this fix. If immediate patching is not possible, disable the net: drop_monitor module if not required.

Hi! I’m here to help you understand CVE-2026-68288. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70