All vulnerabilities
CVE-2026-98419

Linux: drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in56b12f0cd476e4d90a0e2663a80102b388ebf78cAlso 88d640efd655b10f9fa4e381caf777da1f17c2a6, 8a04047c6dbff2f49a561b1ff53b043f4807e855 and 3 moreCVE List
Published14 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 56b12f0cd476e4d90a0e2663a80102b388ebf78cLinuxCVE List
  • 88d640efd655b10f9fa4e381caf777da1f17c2a6LinuxCVE List
  • 8a04047c6dbff2f49a561b1ff53b043f4807e855LinuxCVE List
  • 530ae0a1458078c7a81fbffd9ff17d42129364d9LinuxCVE List
  • 03b672eba4937ff18337049824a114012d57f202LinuxCVE List
  • 439f392084f8f7f59ab9d47a9579185accefe1d8LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In reset_per_cpu_data(), al is computed as:

al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr);

skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al);

Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info.

Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.

Text from CVE List

Affected versions 18

  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before caf09c09e0f323015ab6777ed1bad5aa10688631CVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before 56b12f0cd476e4d90a0e2663a80102b388ebf78cCVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before 88d640efd655b10f9fa4e381caf777da1f17c2a6CVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before d54a044136b129822715e8798899af540ec7a9e9CVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before 8a04047c6dbff2f49a561b1ff53b043f4807e855CVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before 530ae0a1458078c7a81fbffd9ff17d42129364d9CVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before 03b672eba4937ff18337049824a114012d57f202CVE List
  • Linuxaffected: 683703a26e4677db437a1480682851e27c7a154f before 439f392084f8f7f59ab9d47a9579185accefe1d8CVE List
  • Linuxaffected: 2.6.31CVE List
  • Linuxunaffected: all versions before 2.6.31CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8