FKIE_CVE-2026-98419

Vulnerability from fkie_nvd - Published: 2026-10-14 14:17 - Updated: 2026-10-14 14:17
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr); skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al); Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info. Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "03b672eba4937ff18337049824a114012d57f202",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
    }
  ],
  "id": "CVE-2026-98419",
  "lastModified": "2026-10-14T14:17:53.290",
  "metrics": {},
  "published": "2026-10-14T14:17:53.290",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.