CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlinklog: fix uninitialized padding leak in NFULAPAYLOAD
buildpacketmessage() manually constructs the NFULAPAYLOAD netlink attribute using skbput() and skbcopybits(), bypassing the standard nlareserve()/nlaput() helpers. While nlatotalsize(datalen) bytes are allocated (including NLA alignment padding), only datalen bytes of actual packet data are copied. The trailing nlapadlen(datalen) bytes (1-3 when datalen is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.
Replace the manual attribute construction with nlareserve(), which handles the tailroom check, header setup, and padding zeroing via nlareserve(). The subsequent skbcopybits() fills in the payload data on top of the properly initialized attribute.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
Who can observe the leaked data?
The stale heap contents are exposed to userspace through an NFLOG netlink socket. This is a local issue, reflected by the local attack vector.
What conditions cause data to be leaked?
A leak occurs when the NFULA_PAYLOAD packet-data length is not aligned to four bytes. In that case, one to three trailing netlink alignment-padding bytes are left uninitialized and sent to userspace.
Does exploitation require elevated access or user interaction?
The supplied vector indicates low privileges are required and no user interaction is required. The issue affects confidentiality only; integrity and availability are not affected according to the vector.
What is the remediation?
Apply a kernel update containing the change that replaces manual NFULA_PAYLOAD attribute construction with nla_reserve(), which initializes alignment padding before packet data is copied.