CVE-2026-68286

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-68286", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-30T09:28:09.379Z", "datePublished": "2026-08-10T12:02:19.077Z", "dateUpdated": "2026-10-03T10:55:41.847Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-03T10:55:41.847Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: perform u64_stats updates under IRQ-disabled section\n\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\n\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\n\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/drop_monitor.c"], "versions": [{"version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "lessThan": "dd8472526a04f2185afd792b8041a912a7d75d85", "status": "affected", "versionType": "git"}, {"version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "lessThan": "3454c729ee8aa682ec871f1b174b047f731933ae", "status": "affected", "versionType": "git"}, {"version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "lessThan": "be9b121894d6ad44f0011f79543a2e3245979497", "status": "affected", "versionType": "git"}, {"version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "lessThan": "7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04", "status": "affected", "versionType": "git"}, {"version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "lessThan": "d5e2cd2bc8ae36617346b3a54ee9da61d866bf92", "status": "affected", "versionType": "git"}, {"version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "lessThan": "fd098a23bf8fda7eae48db9b06e7c34fc4d228fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/core/drop_monitor.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.111", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.6", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.12.111"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.1.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/dd8472526a04f2185afd792b8041a912a7d75d85"}, {"url": "https://git.kernel.org/stable/c/3454c729ee8aa682ec871f1b174b047f731933ae"}, {"url": "https://git.kernel.org/stable/c/be9b121894d6ad44f0011f79543a2e3245979497"}, {"url": "https://git.kernel.org/stable/c/7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04"}, {"url": "https://git.kernel.org/stable/c/d5e2cd2bc8ae36617346b3a54ee9da61d866bf92"}, {"url": "https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}], "title": "drop_monitor: perform u64_stats updates under IRQ-disabled section", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/core/drop_monitor.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "dd8472526a04f2185afd792b8041a912a7d75d85", "status": "affected", "version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "versionType": "git"}, {"lessThan": "3454c729ee8aa682ec871f1b174b047f731933ae", "status": "affected", "version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "versionType": "git"}, {"lessThan": "be9b121894d6ad44f0011f79543a2e3245979497", "status": "affected", "version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "versionType": "git"}, {"lessThan": "7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04", "status": "affected", "version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "versionType": "git"}, {"lessThan": "d5e2cd2bc8ae36617346b3a54ee9da61d866bf92", "status": "affected", "version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "versionType": "git"}, {"lessThan": "fd098a23bf8fda7eae48db9b06e7c34fc4d228fa", "status": "affected", "version": "e9feb58020f952f7d9de785ede9a7d54ab1eda5c", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/core/drop_monitor.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"lessThan": "5.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.111", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: perform u64_stats updates under IRQ-disabled section\n\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\n\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\n\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update."}], "id": "CVE-2026-68286", "lastModified": "2026-10-03T11:17:36.300", "metrics": {}, "published": "2026-08-10T13:20:17.903", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3454c729ee8aa682ec871f1b174b047f731933ae"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be9b121894d6ad44f0011f79543a2e3245979497"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d5e2cd2bc8ae36617346b3a54ee9da61d866bf92"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dd8472526a04f2185afd792b8041a912a7d75d85"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: drop_monitor data corruption due to race condition", "id": "2513389", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513389"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ndrop_monitor: perform u64_stats updates under IRQ-disabled section\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update.", "A flaw was found in the Linux kernel's drop_monitor component. On 32-bit architectures, a race condition can occur during the update of 64-bit statistics. If a nested interrupt happens on the same CPU while these statistics are being updated, it can lead to the corruption of internal sequence counters or the statistical values themselves. This data corruption could potentially impact system stability or lead to inaccurate monitoring information."], "name": "CVE-2026-68286", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_nvidia:", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux for NVIDIA 26"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-08-10T12:02:19Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-68286\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-68286\nhttps://git.kernel.org/stable/c/d5e2cd2bc8ae36617346b3a54ee9da61d866bf92\nhttps://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9feb58020f952f7d9de785ede9a7d54ab1eda5c,d5e2cd2bc8ae36617346b3a54ee9da61d866bf92)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e9feb58020f952f7d9de785ede9a7d54ab1eda5c,fd098a23bf8fda7eae48db9b06e7c34fc4d228fa)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.6,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-10T18:15:11.381993+00:00", "updated": "2026-08-13T06:30:05.414151+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}