CVE-2026-68286
In the Linux kernel, the following vulnerability has been resolved: drop_monitor: perform u64_stats updates under IRQ-disabled section In net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(), u64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were called after spin_unlock_irqrestore(&...drop_queue.lock, flags), when local IRQs had already been re-enabled. Tracepoint probes can execute in IRQ or softirq context. On 32-bit architectures, u64_stats_update_begin() disables preemption but not interrupts, relying on seqcount writes. If a nested interrupt occurs on the same CPU during the 64-bit stats update, the reentrant seqcount update can corrupt the seqcount state or stats value. Fix this by performing the 64-bit per-CPU stats update before releasing drop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain disabled during the u64_stats update.
Affected versions
Linux kernel versions
5.4
and later are affected. Fixed in
6.1.189,
6.6.158,
6.12.111,
6.18.53,
7.1.6,
7.2
and their respective stable series.
References
6 totalFrequently asked questions
-
What is CVE-2026-68286?
CVE-2026-68286 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.4 onward and has been patched in 6.1.189, 6.6.158, 6.12.111 and others. CVE-2026-68286 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-68286?
Yes. CVE-2026-68286 has been patched. Fixed versions include 6.1.189, 6.6.158, 6.12.111 and others. If you are running Linux kernel 5.4 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-68286 actively exploited?
No. CVE-2026-68286 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.