CVE-2026-68286

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drop_monitor: perform u64_stats updates under IRQ-disabled section

In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),

u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were

called after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local

IRQs had already been re-enabled.

Tracepoint probes can execute in IRQ or softirq context. On 32-bit

architectures, u64_stats_update_begin() disables preemption but not interrupts,

relying on seqcount writes. If a nested interrupt occurs on the same CPU during

the 64-bit stats update, the reentrant seqcount update can corrupt the

seqcount state or stats value.

Fix this by performing the 64-bit per-CPU stats update before releasing

drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain

disabled during the u64_stats update.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References