CVE-2026-68288: net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD

net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code
the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload
before overwriting it with skb_copy_bits().

skb_put() reserves nla_total_size(payload_len), i.e. the header plus the
NLA_ALIGN() padding, but only payload_len bytes are copied in. When
payload_len is not a multiple of 4 the 1-3 padding bytes are never
initialized and are leaked to user space inside the netlink message.

KMSAN confirms the leak for the software path when the packet payload
length is not 4-byte aligned:

  BUG: KMSAN: kernel-infoleak in _copy_to_iter
   _copy_to_iter
   __skb_datagram_iter
   skb_copy_datagram_iter
   netlink_recvmsg
   sock_recvmsg
   __sys_recvfrom
  Uninit was created at:
   kmem_cache_alloc_node_noprof
   __alloc_skb
   net_dm_packet_work
  Bytes 173-175 of 176 are uninitialized

Use __nla_reserve(), which sets up the attribute header and zeroes the
padding, instead of open coding the attribute construction.

The Linux kernel CVE team has assigned CVE-2026-68288 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.4 with commit ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f and fixed in 7.1.6 with commit 8fd6975d2aecc36b25ee82b6aef88e62a3527ccb
	Issue introduced in 5.4 with commit ca30707dee2bc8bc81cfd8b4277fe90f7ca6df1f and fixed in 7.2-rc5 with commit 5e9c8baee0329fbefe7c67aea945e2a07f15e98b

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68288
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/core/drop_monitor.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8fd6975d2aecc36b25ee82b6aef88e62a3527ccb
	https://git.kernel.org/stable/c/5e9c8baee0329fbefe7c67aea945e2a07f15e98b