Linux Kernel CVE-2026-68287

The Linux kernel's drop_monitor subsystem (CONFIG_NET_DROP_MONITOR) delivers real-time network packet-drop telemetry via netlink. The affected functions net_dm_packet_report_fill() and net_dm_hw_packet_report_fill() serialize NET_DM_ATTR_PC and NET_DM_ATTR_TIMESTAMP as 64-bit attributes using nla_put_u64_64bit(). On 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS, nla_put_u64_64bit() inserts a 4-byte NET_DM_ATTR_PAD attribute before each 64-bit field to satisfy alignment requirements, making each attribute consume up to 16 bytes rather than the 12 bytes budgeted by nla_total_size(sizeof(u64)). The root cause is a buffer-size calculation error (functionally equivalent to CWE-131: Incorrect Calculation of Buffer Size) where the wrong size-estimation helper was used: nla_total_size() instead of nla_total_size_64bit(). When the actual serialization call subsequently invokes __nla_reserve() or skb_put() to write past the end of the under-sized SKB, the kernel's bounds-check fires as skb_over_panic(). CPE: cpe:2.3:a:linux:linux:*. The bug is architectural and compile-time configuration dependent, not present on 64-bit builds or on 32-bit builds with efficient unaligned access enabled.