CVE-2026-68286

In the Linux kernel, the following vulnerability has been resolved:

dropmonitor: perform u64stats updates under IRQ-disabled section

In netdmpackettracekfreeskbhit() and netdmhwtrappacketprobe(), u64statsupdatebegin() / u64statsinc() / u64statsupdateend() were called after spinunlockirqrestore(&...dropqueue.lock, flags), when local IRQs had already been re-enabled.

Tracepoint probes can execute in IRQ or softirq context. On 32-bit architectures, u64statsupdate_begin() disables preemption but not interrupts, relying on seqcount writes. If a nested interrupt occurs on the same CPU during the 64-bit stats update, the reentrant seqcount update can corrupt the seqcount state or stats value.

Fix this by performing the 64-bit per-CPU stats update before releasing dropqueue.lock via spinunlockirqrestore(), ensuring local interrupts remain disabled during the u64stats update.