{"id":"CVE-2026-68286","state":"PUBLISHED","title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: perform u64_stats updates under IRQ-disabled section\n\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\n\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\n\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update.","publishedAt":"2026-08-10T12:02:19.077Z","updatedAt":"2026-10-03T10:55:41.847Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"dd8472526a04f2185afd792b8041a912a7d75d85","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"3454c729ee8aa682ec871f1b174b047f731933ae","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"be9b121894d6ad44f0011f79543a2e3245979497","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"d5e2cd2bc8ae36617346b3a54ee9da61d866bf92","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/drop_monitor.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.4","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/drop_monitor.c"]}],"references":["https://git.kernel.org/stable/c/dd8472526a04f2185afd792b8041a912a7d75d85","https://git.kernel.org/stable/c/3454c729ee8aa682ec871f1b174b047f731933ae","https://git.kernel.org/stable/c/be9b121894d6ad44f0011f79543a2e3245979497","https://git.kernel.org/stable/c/7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04","https://git.kernel.org/stable/c/d5e2cd2bc8ae36617346b3a54ee9da61d866bf92","https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:49.727Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/68xxx/CVE-2026-68286.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68286","state":"PUBLISHED","datePublished":"2026-08-10T12:02:19.077Z","dateUpdated":"2026-10-03T10:55:41.847Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-30T09:28:09.379Z"},"containers":{"cna":{"title":"drop_monitor: perform u64_stats updates under IRQ-disabled section","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: perform u64_stats updates under IRQ-disabled section\n\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\n\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\n\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"dd8472526a04f2185afd792b8041a912a7d75d85","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"3454c729ee8aa682ec871f1b174b047f731933ae","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"be9b121894d6ad44f0011f79543a2e3245979497","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"d5e2cd2bc8ae36617346b3a54ee9da61d866bf92","versionType":"git"},{"version":"e9feb58020f952f7d9de785ede9a7d54ab1eda5c","status":"affected","lessThan":"fd098a23bf8fda7eae48db9b06e7c34fc4d228fa","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/drop_monitor.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.4","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.4","versionType":"semver"},{"version":"6.1.189","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.158","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.111","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.53","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.6","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/core/drop_monitor.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/dd8472526a04f2185afd792b8041a912a7d75d85"},{"url":"https://git.kernel.org/stable/c/3454c729ee8aa682ec871f1b174b047f731933ae"},{"url":"https://git.kernel.org/stable/c/be9b121894d6ad44f0011f79543a2e3245979497"},{"url":"https://git.kernel.org/stable/c/7d857cf5f0120bb0e020fa20b03bd21b9d3e0c04"},{"url":"https://git.kernel.org/stable/c/d5e2cd2bc8ae36617346b3a54ee9da61d866bf92"},{"url":"https://git.kernel.org/stable/c/fd098a23bf8fda7eae48db9b06e7c34fc4d228fa"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-03T10:55:41.847Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.1.189"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.6.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.12.111"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"6.18.53"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}