CVE-2026-68287: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-68287 Overview

CVE-2026-68287 is a Linux kernel vulnerability in the drop_monitor subsystem. The flaw stems from incorrect size calculations for 64-bit netlink attributes in net_dm_packet_report_fill() and net_dm_hw_packet_report_fill(). Both functions use nla_put_u64_64bit() to append the NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP attributes, but the corresponding size helpers under-estimate the required socket buffer space. On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, this mismatch triggers skb_over_panic() when the kernel later reserves or writes past the allocated buffer, causing a kernel panic and denial of service.

Critical Impact
A remote attacker can trigger skb_over_panic() in the Linux kernel drop_monitor path, resulting in a kernel panic and full system denial of service on affected 32-bit builds.

Affected Products

Linux kernel builds enabling the drop_monitor (CONFIG_NET_DROP_MONITOR) subsystem
32-bit architectures compiled without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
Distributions shipping kernels prior to the upstream fixes referenced by commits 4a9e30764e80 and 7089f7ab99c8

Discovery Timeline

2026-08-10 - CVE-2026-68287 published to NVD
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68287

Vulnerability Analysis

The Linux kernel's drop_monitor component reports dropped network packets to userspace over a netlink multicast socket. When building each report, net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() append two 64-bit attributes (NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP) using nla_put_u64_64bit().

On 32-bit architectures lacking efficient unaligned access, nla_put_u64_64bit() may insert an additional 4-byte NET_DM_ATTR_PAD attribute to align the 64-bit value on an 8-byte boundary. The size accounting functions, however, called nla_total_size(sizeof(u64)) and budgeted only 12 bytes per attribute instead of the up to 16 bytes actually consumed after padding.

When many drops occur, the socket buffer allocated by the reporting path is smaller than the data written into it. Subsequent calls to __nla_reserve() or skb_put() exceed the tail, triggering skb_over_panic() and halting the kernel.

Root Cause

The root cause is an under-allocation of an SKB caused by using nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)) when calculating drop report sizes. Only the latter accounts for the padding attribute inserted by nla_put_u64_64bit() on affected architectures. This is a boundary condition error affecting kernel memory reservation logic.

Attack Vector

Exploitation requires that drop monitoring is enabled and that a workload generates enough packet drops to fill a report near the buffer boundary. Because packet drops can be induced from the network, an unauthenticated remote attacker can send crafted traffic to a monitored host to precipitate the panic. Successful exploitation crashes the kernel and produces a denial-of-service condition; the flaw does not disclose data or grant code execution.

No public exploit code has been published. Technical details of the fix are available in the Linux Kernel Patch Note and the Linux Kernel Change Log.

Detection Methods for CVE-2026-68287

Indicators of Compromise

Kernel panic messages containing skb_over_panic with a backtrace referencing net_dm_packet_report_fill or net_dm_hw_packet_report_fill
Unexpected reboots on 32-bit hosts with CONFIG_NET_DROP_MONITOR enabled during periods of elevated packet drops
Netlink consumers on the NET_DM multicast group disconnecting immediately before a host crash

Detection Strategies

Inventory running kernels and flag 32-bit builds compiled without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS and with CONFIG_NET_DROP_MONITOR=y
Correlate host crash telemetry with preceding spikes in network drop rates or drop_monitor activity
Monitor dmesg and journalctl -k for skb_over_panic strings and export findings to a centralized log store

Monitoring Recommendations

Aggregate kernel oops and panic events centrally and alert on skb_over_panic signatures
Track uptime regressions across Linux fleets to surface repeat crash patterns tied to this bug
Baseline drop_monitor traffic volume so anomalous surges preceding crashes are visible to responders

How to Mitigate CVE-2026-68287

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 4a9e30764e80 and 7089f7ab99c8 or upgrade to a distribution kernel that includes the fix
Disable drop_monitor on 32-bit systems that cannot be patched immediately by unloading the drop_monitor module or stopping consumers of the NET_DM multicast group
Prioritize remediation on internet-facing 32-bit hosts where remote traffic can influence drop rates

Patch Information

The fix replaces nla_total_size(sizeof(u64)) with nla_total_size_64bit(sizeof(u64)) in both net_dm_packet_report_size() and net_dm_hw_packet_report_size(), correctly reserving space for the alignment padding. Vendor patches are tracked in the Linux Kernel Patch Note and the Linux Kernel Change Log. Rebuild custom kernels from a source tree that incorporates both commits.

Workarounds

Unload the drop_monitor kernel module with rmmod drop_monitor where it is not required for observability
Restrict access to the NET_DM netlink multicast group so only trusted processes can subscribe to drop reports
Rebuild 32-bit kernels with CONFIG_NET_DROP_MONITOR=n until patched kernels are deployed

bash

# Disable drop_monitor at runtime and prevent it from auto-loading
sudo rmmod drop_monitor
echo 'blacklist drop_monitor' | sudo tee /etc/modprobe.d/blacklist-drop_monitor.conf

# Verify installed kernel includes the fix
uname -r
grep -E 'drop_monitor|nla_total_size_64bit' /proc/kallsyms | head