CVE-2026-98419 (GCVE-0-2026-98419)
Vulnerability from cvelistv5
Published
2026-10-14 13:27
Modified
2026-10-24 14:08
Severity ?
7.0 (High) - CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr); skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al); Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info. Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.
References
Impacted products
Vendor Product Version
Linux Linux Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
Version: 683703a26e4677db437a1480682851e27c7a154f
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "03b672eba4937ff18337049824a114012d57f202",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - On affected 2.6.32-era 4-byte-cache builds, local NETLINK_GENERIC NET_DM_CMD_START enters net_dm_cmd_trace(); locally generated drops then run trace_drop_common()-\u003esched_send_work()-\u003esend_dm_alert()-\u003ereset_per_cpu_data(). No routable protocol message supplies al.\nAC:H - The harmful layout requires non-default CONFIG_NET_DROP_MONITOR on H8/300 or early MicroBlaze, where SMP_CACHE_BYTES is 4 and skb_shared_info begins with dataref; that rare target condition is outside attacker control. The attacker can otherwise fill the alert and control both multicast listeners without racing.\nPR:L - In those affected kernels NET_DM_CMD_START has no GENL_ADMIN_PERM, while NETLINK_GENERIC enables NL_NONROOT_RECV, so an ordinary local user can start tracing and join the alert group without a user namespace or initial-namespace capability.\nUI:N - The local attacker sends START, creates the listener sockets, generates dropped skbs, and receives the alerts; no separate victim action is required.\nS:U - The corrupted skb_shared_info and subsequent use-after-free remain within the host kernel; this is ordinary kernel compromise rather than a VM, IOMMU, or sandbox boundary crossing.\nC:H - reset_per_cpu_data() zeroes dataref from 1 to 0. After a full alert makes netlink_trim() retain the head, a second listener causes skb_clone() to count two heads as one reference; receiving the first frees the head and the second can read attacker-groomed reclaimed heap.\nI:H - The queued clone survives after its head is freed; reclaiming and forging that allocation lets its later skb_release_data() decrement and process attacker-shaped skb_shared_info metadata, providing exploitable use-after-free memory corruption.\nA:H - The prematurely freed head remains referenced by the second queued clone, so skb_copy_datagram_iovec() or its later skb_release_data() can access reclaimed memory and crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:08:45.212Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
        },
        {
          "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
        },
        {
          "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
        },
        {
          "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
        },
        {
          "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
        }
      ],
      "title": "drop_monitor: fix out-of-bounds write in reset_per_cpu_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98419",
    "datePublished": "2026-10-14T13:27:49.005Z",
    "dateReserved": "2026-09-25T10:25:14.348Z",
    "dateUpdated": "2026-10-24T14:08:45.212Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.