CVE-2026-68288

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD<br /> <br /> net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code<br /> the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload<br /> before overwriting it with skb_copy_bits().<br /> <br /> skb_put() reserves nla_total_size(payload_len), i.e. the header plus the<br /> NLA_ALIGN() padding, but only payload_len bytes are copied in. When<br /> payload_len is not a multiple of 4 the 1-3 padding bytes are never<br /> initialized and are leaked to user space inside the netlink message.<br /> <br /> KMSAN confirms the leak for the software path when the packet payload<br /> length is not 4-byte aligned:<br /> <br /> BUG: KMSAN: kernel-infoleak in _copy_to_iter<br /> _copy_to_iter<br /> __skb_datagram_iter<br /> skb_copy_datagram_iter<br /> netlink_recvmsg<br /> sock_recvmsg<br /> __sys_recvfrom<br /> Uninit was created at:<br /> kmem_cache_alloc_node_noprof<br /> __alloc_skb<br /> net_dm_packet_work<br /> Bytes 173-175 of 176 are uninitialized<br /> <br /> Use __nla_reserve(), which sets up the attribute header and zeroes the<br /> padding, instead of open coding the attribute construction.