CVE-2026-68288: Linux Kernel Information Disclosure Flaw

CVE-2026-68288 Overview

CVE-2026-68288 is an information disclosure vulnerability in the Linux kernel's drop_monitor subsystem. The flaw resides in net_dm_packet_report_fill() and net_dm_hw_packet_report_fill(), which construct the NET_DM_ATTR_PAYLOAD netlink attribute manually. When the packet payload length is not a multiple of 4 bytes, the NLA_ALIGN() padding bytes remain uninitialized. Those 1-3 uninitialized bytes are then transmitted to user space inside the netlink message, leaking kernel memory contents. KMSAN confirmed the leak in the software path. The issue has been resolved upstream by switching to __nla_reserve(), which zeroes the padding.

Critical Impact
Local users with access to drop_monitor netlink messages can receive kernel memory contents through unaligned payload padding, enabling potential disclosure of sensitive kernel data.

Affected Products

Linux kernel versions containing the net: drop_monitor subsystem
Systems exposing net_dm netlink interfaces to user space
Distributions shipping kernels prior to the referenced stable commits

Discovery Timeline

2026-08-10 - CVE-2026-68288 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68288

Vulnerability Analysis

The vulnerability is an uninitialized memory disclosure [CWE-908] in the kernel's network drop monitor. The drop_monitor facility reports dropped packets to user space over a generic netlink socket. Two functions, net_dm_packet_report_fill() and net_dm_hw_packet_report_fill(), construct the NET_DM_ATTR_PAYLOAD attribute by hand rather than using the standard helpers. This manual construction was intended to skip zeroing the payload buffer before overwriting it with skb_copy_bits(), saving a memset. The optimization introduced a bug in the handling of netlink attribute alignment padding.

Root Cause

Netlink attributes must be padded to a 4-byte boundary. The code calls skb_put(nla_total_size(payload_len)), which reserves space for the attribute header plus NLA_ALIGN(payload_len) bytes. Only payload_len bytes are then written by skb_copy_bits(). When payload_len is not a multiple of 4, the trailing 1 to 3 alignment bytes retain whatever data occupied that slab memory previously. KMSAN reports the leak originating from kmem_cache_alloc_node_noprof through __alloc_skb and net_dm_packet_work, with bytes 173-175 of a 176-byte allocation uninitialized.

Attack Vector

A local user with permission to open the drop_monitor generic netlink family and receive drop reports can observe uninitialized kernel memory in the padding bytes of every unaligned payload. Repeatedly collecting drop reports allows an attacker to sample kernel heap contents. The disclosed bytes may contain pointers useful for defeating kernel address space layout randomization or fragments of adjacent objects. The fix replaces the open-coded construction with __nla_reserve(), which installs the attribute header and zeroes the alignment padding.

See the kernel commits at Kernel Git Commit 5e9c8ba and Kernel Git Commit 8fd6975 for the exact patch.

Detection Methods for CVE-2026-68288

Indicators of Compromise

No specific runtime IOCs exist for this info leak because reads occur through legitimate netlink APIs.
Presence of unexpected processes opening the NET_DM generic netlink family on production systems warrants review.
Kernel versions matching the vulnerable range without the referenced stable patches applied.

Detection Strategies

Audit installed kernel packages against distribution advisories referencing the two stable commits.
Use genl-ctrl-list or equivalent tooling to enumerate processes with access to the NET_DM netlink family.
Enable KMSAN or KASAN in test environments to validate that vendor-shipped kernels include the fix.

Monitoring Recommendations

Log socket() and bind() syscalls that reference AF_NETLINK with the generic family on sensitive hosts.
Alert on non-root or unexpected user contexts subscribing to drop_monitor multicast groups.
Track kernel package version drift against the patched commits across the fleet.

How to Mitigate CVE-2026-68288

Immediate Actions Required

Apply the upstream fix from commits 5e9c8ba and 8fd6975 or install a distribution kernel that includes them.
Restrict access to the drop_monitor netlink interface to root-only workflows where feasible.
Verify that unprivileged user namespaces are not granting CAP_NET_ADMIN inside container workloads.

Patch Information

The fix replaces the open-coded NET_DM_ATTR_PAYLOAD construction with __nla_reserve(), which reserves the attribute space and zeroes the NLA_ALIGN() padding before skb_copy_bits() writes the payload. Distribution kernels should pick up the fix through their normal stable backport process. Reference the two stable tree commits linked in the kernel Git repository for the exact patch content.

Workarounds

Disable CONFIG_NET_DROP_MONITOR in custom kernel builds where the feature is not required.
Blacklist or unload the drop_monitor module on systems where it is dynamically loaded.
Constrain CAP_NET_ADMIN via seccomp or LSM policies to prevent unprivileged access to drop_monitor sockets.

bash

# Verify kernel version and check whether the drop_monitor module is loaded
uname -r
lsmod | grep drop_monitor

# Prevent the module from loading on systems that do not need it
echo "blacklist drop_monitor" | sudo tee /etc/modprobe.d/blacklist-drop-monitor.conf
sudo depmod -a