CVE-2026-98419
Status: ReceivedUnscored—
Severity—Unscored
Exploitation probability0.22 %higher than 12% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found
In the Linux kernel, the following vulnerability has been resolved:
drop_monitor: fix out-of-bounds write in reset_per_cpu_data()
In reset_per_cpu_data(), al is computed as:
Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg_new() allocates al bytes of tailroom starting at nla. However, msg points to nla_data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb_shared_info.
Fix this by letting al represent only the payload length, allocating the skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing al bytes from msg.
Technical details traces, logs and code from the original report
al = sizeof(struct net_dm_alert_msg);
al += dm_hit_limit * sizeof(struct net_dm_drop_point);
al += sizeof(struct nlattr);
skb = genlmsg_new(al, GFP_KERNEL);
...
nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));
...
msg = nla_data(nla);
memset(msg, 0, al);CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.22 %
- Percentile among all scored CVEs
- 12
- Score date
- 10/21/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Show 8 references
- https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202
- https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8
- https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9
- https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c
- https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6
- https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855
- https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631
- https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98419",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "caf09c09e0f323015ab6777ed1bad5aa10688631",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "56b12f0cd476e4d90a0e2663a80102b388ebf78c",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "88d640efd655b10f9fa4e381caf777da1f17c2a6",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "d54a044136b129822715e8798899af540ec7a9e9",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "8a04047c6dbff2f49a561b1ff53b043f4807e855",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "530ae0a1458078c7a81fbffd9ff17d42129364d9",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "03b672eba4937ff18337049824a114012d57f202",
"versionType": "git"
},
{
"status": "affected",
"version": "683703a26e4677db437a1480682851e27c7a154f",
"lessThan": "439f392084f8f7f59ab9d47a9579185accefe1d8",
"versionType": "git"
}
],
"programFiles": [
"net/core/drop_monitor.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.31"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.31",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.54",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.8",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/drop_monitor.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-14T14:17:53.290",
"references": [
{
"url": "https://git.kernel.org/stable/c/03b672eba4937ff18337049824a114012d57f202",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/439f392084f8f7f59ab9d47a9579185accefe1d8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/530ae0a1458078c7a81fbffd9ff17d42129364d9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/56b12f0cd476e4d90a0e2663a80102b388ebf78c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/88d640efd655b10f9fa4e381caf777da1f17c2a6",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8a04047c6dbff2f49a561b1ff53b043f4807e855",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/caf09c09e0f323015ab6777ed1bad5aa10688631",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/d54a044136b129822715e8798899af540ec7a9e9",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrop_monitor: fix out-of-bounds write in reset_per_cpu_data()\n\nIn reset_per_cpu_data(), al is computed as:\n\n al = sizeof(struct net_dm_alert_msg);\n al += dm_hit_limit * sizeof(struct net_dm_drop_point);\n al += sizeof(struct nlattr);\n\n skb = genlmsg_new(al, GFP_KERNEL);\n ...\n nla = nla_reserve(skb, NLA_UNSPEC, sizeof(struct net_dm_alert_msg));\n ...\n msg = nla_data(nla);\n memset(msg, 0, al);\n\nBecause al includes sizeof(struct nlattr) (the 4-byte attribute header),\ngenlmsg_new() allocates al bytes of tailroom starting at nla.\nHowever, msg points to nla_data(nla), which is located\nsizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al)\ntherefore writes al bytes starting from msg, exceeding the allocated\nbuffer by sizeof(struct nlattr) (4 bytes) and corrupting\nskb_shared_info.\n\nFix this by letting al represent only the payload length, allocating\nthe skb with genlmsg_new(nla_total_size(al), GFP_KERNEL), and zeroing\nal bytes from msg."
}
],
"lastModified": "2026-10-19T10:18:47.367",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}