CVE-2026-68288

In the Linux kernel, the following vulnerability has been resolved:

net: dropmonitor: fix info leak in NETDMATTRPAYLOAD

netdmpacketreportfill() and netdmhwpacketreportfill() open code the NETDMATTRPAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skbcopybits().

skbput() reserves nlatotalsize(payloadlen), i.e. the header plus the NLAALIGN() padding, but only payloadlen bytes are copied in. When payload_len is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message.

KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned:

BUG: KMSAN: kernel-infoleak in copytoiter copytoiter __skbdatagramiter skb_copydatagramiter netlinkrecvmsg sockrecvmsg __sysrecvfrom Uninit was created at: kmemcache_allocnodenoprof __allocskb netdmpacketwork Bytes 173-175 of 176 are uninitialized

Use _nlareserve(), which sets up the attribute header and zeroes the padding, instead of open coding the attribute construction.