CVE-2026-68286 drop_monitor: perform u64_stats updates under IRQ-disabled section
A race condition in the Linux kernel drop_monitor allows local attackers to corrupt statistics or cause denial of service on 32-bit systems.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-68286?
CVE-2026-68286 is a vulnerability in Linux, published on 10 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
drop_monitor: perform u64_stats updates under IRQ-disabled section
In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were called after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local IRQs had already been re-enabled.
Tracepoint probes can execute in IRQ or softirq context. On 32-bit architectures, u64_stats_update_begin() disables preemption but not interrupts, relying on seqcount writes. If a nested interrupt occurs on the same CPU during the 64-bit stats update, the reentrant seqcount update can corrupt the seqcount state or stats value.
Fix this by performing the 64-bit per-CPU stats update before releasing drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain disabled during the u64_stats update.
Which versions are affected by CVE-2026-68286?
How do I fix CVE-2026-68286?
Apply the vendor's patch.
Is CVE-2026-68286 being exploited?
There is no known exploitation of CVE-2026-68286 in the wild and no public exploit code.
Sources
Also known as AZL-95229, BELL-CVE-2026-68286, DEBIAN-CVE-2026-68286, GHSA-xcpv-vj7m-3hh9, UBUNTU-CVE-2026-68286.