CVE-2026-98419

In the Linux kernel, the following vulnerability has been resolved:

drop monitor: fix out-of-bounds write in reset per cpu data()

In reset per cpu data(), al is computed as:

al = sizeof(struct net dm alert msg); al += dm hit limit * sizeof(struct net dm drop point); al += sizeof(struct nlattr);

skb = genlmsg new(al, GFP KERNEL); ... nla = nla reserve(skb, NLA UNSPEC, sizeof(struct net dm alert msg)); ... msg = nla data(nla); memset(msg, 0, al);

Because al includes sizeof(struct nlattr) (the 4-byte attribute header), genlmsg new() allocates al bytes of tailroom starting at nla. However, msg points to nla data(nla), which is located sizeof(struct nlattr) bytes past nla. Calling memset(msg, 0, al) therefore writes al bytes starting from msg, exceeding the allocated buffer by sizeof(struct nlattr) (4 bytes) and corrupting skb shared info.

Fix this by letting al represent only the payload length, allocating the skb with genlmsg new(nla total size(al), GFP KERNEL), and zeroing al bytes from msg.