CVE-2026-68286

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> drop_monitor: perform u64_stats updates under IRQ-disabled section<br /> <br /> In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),<br /> u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were<br /> called after spin_unlock_irqrestore(&amp;...drop_queue.lock, flags), when local<br /> IRQs had already been re-enabled.<br /> <br /> Tracepoint probes can execute in IRQ or softirq context. On 32-bit<br /> architectures, u64_stats_update_begin() disables preemption but not interrupts,<br /> relying on seqcount writes. If a nested interrupt occurs on the same CPU during<br /> the 64-bit stats update, the reentrant seqcount update can corrupt the<br /> seqcount state or stats value.<br /> <br /> Fix this by performing the 64-bit per-CPU stats update before releasing<br /> drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain<br /> disabled during the u64_stats update.