Vulnerability-Lookup

CVE-2026-98419 (GCVE-0-2026-98419)

Vulnerability from cvelistv5 – Published: 2026-10-14 13:27 – Updated: 2026-10-14 13:27

Title

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

Summary

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr); skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al); Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info. Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.

Severity

No CVSS data available.

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6666 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/caf09c09e0f323015…
https://git.kernel.org/stable/c/56b12f0cd476e4d90…
https://git.kernel.org/stable/c/88d640efd655b10f9…
https://git.kernel.org/stable/c/d54a044136b129822…
https://git.kernel.org/stable/c/8a04047c6dbff2f49…
https://git.kernel.org/stable/c/530ae0a1458078c7a…
https://git.kernel.org/stable/c/03b672eba4937ff18…
https://git.kernel.org/stable/c/439f392084f8f7f59…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 683703a26e4677db437a1480682851e27c7a154f , < caf09c09e0f323015ab6777ed1bad5aa10688631 (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < 56b12f0cd476e4d90a0e2663a80102b388ebf78c (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < 88d640efd655b10f9fa4e381caf777da1f17c2a6 (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < d54a044136b129822715e8798899af540ec7a9e9 (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < 8a04047c6dbff2f49a561b1ff53b043f4807e855 (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < 530ae0a1458078c7a81fbffd9ff17d42129364d9 (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < 03b672eba4937ff18337049824a114012d57f202 (git) Affected: 683703a26e4677db437a1480682851e27c7a154f , < 439f392084f8f7f59ab9d47a9579185accefe1d8 (git)	guessed
Linux	Linux	Affected: 2.6.31 Unaffected: 0 , < 2.6.31 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "03b672eba4937ff18337049824a114012d57f202",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "2.6.31",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T13:27:49.005Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
        },
        {
          "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
        },
        {
          "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
        },
        {
          "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
        },
        {
          "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
        }
      ],
      "title": "drop_monitor: fix out-of-bounds write in reset_per_cpu_data()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98419",
    "datePublished": "2026-10-14T13:27:49.005Z",
    "dateReserved": "2026-09-25T10:25:14.348Z",
    "dateUpdated": "2026-10-14T13:27:49.005Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98419",
      "date": "2026-10-15",
      "epss": "0.0022",
      "percentile": "0.11625"
    },
    "microsoft_vex": {
      "current_release_date": "2026-10-16T01:05:11.000Z",
      "cve": "CVE-2026-98419",
      "id": "msrc_CVE-2026-98419",
      "initial_release_date": "2026-10-16T01:05:11.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "drop_monitor: fix out-of-bounds write in reset_per_cpu_data()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98419.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/drop_monitor.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "03b672eba4937ff18337049824a114012d57f202",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
                    "status": "affected",
                    "version": "683703a26e4677db437a1480682851e27c7a154f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/drop_monitor.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.31"
                  },
                  {
                    "lessThan": "2.6.31",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
          }
        ],
        "id": "CVE-2026-98419",
        "lastModified": "2026-10-14T14:17:53.290",
        "metrics": {},
        "published": "2026-10-14T14:17:53.290",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-10-16T12:10:15+00:00",
      "cve": "CVE-2026-98419",
      "id": "CVE-2026-98419",
      "initial_release_date": "2026-10-14T00:00:00+00:00",
      "product_status:known_affected": "277",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drop_monitor: fix out-of-bounds write in reset_per_cpu_data()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98419.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-98419

Vulnerability from fkie_nvd - Published: 2026-10-14 14:17 - Updated: 2026-10-14 14:17

Severity

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "03b672eba4937ff18337049824a114012d57f202",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            },
            {
              "lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
              "status": "affected",
              "version": "683703a26e4677db437a1480682851e27c7a154f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/drop_monitor.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.31"
            },
            {
              "lessThan": "2.6.31",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
    }
  ],
  "id": "CVE-2026-98419",
  "lastModified": "2026-10-14T14:17:53.290",
  "metrics": {},
  "published": "2026-10-14T14:17:53.290",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-6J59-9PH5-7P77

Vulnerability from github – Published: 2026-10-14 15:32 – Updated: 2026-10-14 15:32

Details

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In reset_per_cpu_data(), al is computed as:

al = sizeof(struct net_dm_alert_msg);
al += dm_hit_limit * sizeof(struct net_dm_drop_point);
al += sizeof(struct nlattr);

skb = genlmsg_new(al, GFP_KERNEL);
...
nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
...
msg = nla_data(nla);
memset(msg, 0, al);

Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info.

Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98419"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-14T14:17:53Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n    al = sizeof(struct net_dm_alert_msg);\n    al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n    al += sizeof(struct nlattr);\n\n    skb = genlmsg_new(al, GFP_KERNEL);\n    ...\n    nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n    ...\n    msg = nla_data(nla);\n    memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg.",
  "id": "GHSA-6j59-9ph5-7p77",
  "modified": "2026-10-14T15:32:21Z",
  "published": "2026-10-14T15:32:21Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98419"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

MSRC_CVE-2026-98419

Vulnerability from csaf_microsoft - Published: 2026-10-16 01:05 - Updated: 2026-10-16 01:05

Summary

drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

Scope

1 vulnerability in this advisory, including CVE-2026-98419.

CVE-2026-98419

Known affected: 1 product

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-98419 (GCVE-0-2026-98419)

FKIE_CVE-2026-98419

GHSA-6J59-9PH5-7P77

MSRC_CVE-2026-98419

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour