Cloudanix VulnDB

CVE-2026-98419

None

CVSS

—

EPSS

0.2%

Published

Oct 14, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A calculation error in the Linux kernel's network monitoring code can let specially crafted network traffic corrupt internal memory structures and crash the system.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds write in reset_per_cpu_data() caused by including sizeof(struct nlattr) in the allocation size 'al' while memset() starts after the header, corrupting skb_shared_info by 4 bytes.

Why it matters to the business

Kernel memory corruption on Linux systems using network drop monitoring can lead to crashes, instability, or potential code execution affecting network infrastructure and services.

How an attack unfolds

An attacker triggers repeated packet drops to reach dm_hit_limit, causing reset_per_cpu_data() to allocate and zero an undersized buffer that overruns into adjacent skb structures.

How to fix it

Apply the upstream kernel patch that corrects al calculation, uses nla_total_size(al) for allocation, and zeros only the payload length; rebuild and deploy updated kernel images.

How to confirm the fix worked

Verify the fix by inspecting the reset_per_cpu_data() implementation for nla_total_size usage and confirming absence of the oversized memset; test with drop_monitor enabled under load.

Typical attack path

  1. Gain ability to induce network packet drops on target system
  2. Configure or reach conditions where dm_hit_limit is exceeded
  3. Invoke reset_per_cpu_data() via drop monitor netlink path
  4. Trigger out-of-bounds memset that corrupts skb_shared_info

How to detect it

Review kernel logs for oops or warnings referencing drop_monitor or skb_shared_info corruption; correlate with netlink activity involving NLA_UNSPEC in drop alert messages.

What your security team should do

  • Prioritize kernel updates for systems exposing drop_monitor
  • Monitor for kernel oops or skb-related panics in logs
  • Restrict access to netlink drop monitor interfaces where possible
  • Track EPSS and exploit maturity updates given recent disclosure

The record

In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix out-of-bounds write in reset_per_cpu_data() In reset_per_cpu_data(), al is computed as: al = sizeof(struct net_dm_alert_msg); al += dm_hit_limit * sizeof(struct net_dm_drop_point); al += sizeof(struct nlattr); skb = genlmsg_new(al, GFP_KERNEL); ... nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg)); ... msg = nla_data(nla); memset(msg, 0, al); Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info. Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.

Affected packages

Ecosystem Package Introduced Fixed