{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD  net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code the NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload before overwriting it with skb_copy_bits().  skb_put() reserves nla_total_size(payload_len), i.e. the header plus the NLA_ALIGN() padding, but only payload_len bytes are copied in. When payload_len is not a multiple of 4 the 1-3 padding bytes are never initialized and are leaked to user space inside the netlink message.  KMSAN confirms the leak for the software path when the packet payload length is not 4-byte aligned:    BUG: KMSAN: kernel-infoleak in _copy_to_iter    _copy_to_iter    __skb_datagram_iter    skb_copy_datagram_iter    netlink_recvmsg    sock_recvmsg    __sys_recvfrom   Uninit was created at:    kmem_cache_alloc_node_noprof    __alloc_skb    net_dm_packet_work   Bytes 173-175 of 176 are uninitialized  Use __nla_reserve(), which sets up the attribute header and zeroes the padding, instead of open coding the attribute construction.",
  "id": "DEBIAN-CVE-2026-68288",
  "modified": "2026-09-14T16:47:39.560101126Z",
  "published": "2026-08-10T13:20:18.123Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68288"
    }
  ],
  "upstream": [
    "CVE-2026-68288"
  ]
}