CVE-2026-68287

Source
https://cve.org/CVERecord?id=CVE-2026-68287
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68287.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-68287
Downstream
Published
2026-08-10T12:02:20.110Z
Modified
2026-08-18T03:30:56.360060792Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
drop_monitor: fix size calculations for 64-bit attributes
Details

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix size calculations for 64-bit attributes

netdmpacketreportfill() and netdmhwpacketreportfill() use nlaputu6464bit() to append 64-bit attributes (NETDMATTRPC and NETDMATTRTIMESTAMP).

On 32-bit architectures without CONFIGHAVEEFFICIENTUNALIGNEDACCESS, nlaputu6464bit() may append a 4-byte NETDMATTRPAD attribute for 64-bit alignment.

However, netdmpacketreportsize() and netdmhwpacketreportsize() used nlatotalsize(sizeof(u64)) instead of nlatotalsize64bit(sizeof(u64)), budgeting 12 bytes instead of up to 16 bytes.

This under-estimation of SKB size can lead to an skboverpanic() when __nlareserve() or skbput() is subsequently called.

Fix this by using nlatotalsize_64bit(sizeof(u64)) in both size calculations.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68287.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f
Fixed
4a9e30764e80693bcf875c776170edce20f94fe0
Fixed
7089f7ab99c89f443c92d8fcc585e63f2727f0b3

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68287.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.4.0
Fixed
7.1.6

Database specific

source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-68287.json"