CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

Q: Who can observe the leaked data?

The stale heap contents are exposed to userspace through an NFLOG netlink socket. This is a local issue, reflected by the local attack vector.

Q: What conditions cause data to be leaked?

A leak occurs when the NFULA_PAYLOAD packet-data length is not aligned to four bytes. In that case, one to three trailing netlink alignment-padding bytes are left uninitialized and sent to userspace.

Q: Does exploitation require elevated access or user interaction?

The supplied vector indicates low privileges are required and no user interaction is required. The issue affects confidentiality only; integrity and availability are not affected according to the vector.

Q: What is the remediation?

Apply a kernel update containing the change that replaces manual NFULA_PAYLOAD attribute construction with nla_reserve(), which initializes alignment padding before packet data is copied.

Published Apr 13, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlinklog: fix uninitialized padding leak in NFULAPAYLOAD

buildpacketmessage() manually constructs the NFULAPAYLOAD netlink attribute using skbput() and skbcopybits(), bypassing the standard nlareserve()/nlaput() helpers. While nlatotalsize(datalen) bytes are allocated (including NLA alignment padding), only datalen bytes of actual packet data are copied. The trailing nlapadlen(datalen) bytes (1-3 when datalen is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.

Replace the manual attribute construction with nlareserve(), which handles the tailroom check, header setup, and padding zeroing via nlareserve(). The subsequent skbcopybits() fills in the payload data on top of the properly initialized attribute.

Affected Software

14 affected componentsFixes available

Linux Linux kernel (netfilter nfnetlink_log)

Microsoft azl3 kernel 6.6.130.1-3

Patch available

Linux Linux kernel>=2.6.24<5.10.253

Linux Linux kernel>=5.11<5.15.203

Linux Linux kernel>=5.16<6.1.168

Linux Linux kernel>=6.2<6.6.131

Linux Linux kernel>=6.7<6.12.80

Linux Linux kernel>=6.13<6.18.21

Linux Linux kernel>=6.19<6.19.11

Linux Linux kernel=7.0-rc1

Linux Linux kernel=7.0-rc2

Linux Linux kernel=7.0-rc3

Linux Linux kernel=7.0-rc4

Linux Linux kernel=7.0-rc5

Event History

Apr 13, 2026

CVE Published

via MITRE·01:40 PM

Data Sourced

via MITRE·01:40 PM

Description

Data Sourced

via NVD·02:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Apr 14, 2026

Data Sourced

via Microsoft·08:02 AM

DescriptionSeverityWeaknessAffected Software

Updated

via Microsoft·08:02 AM

DescriptionSeverity

Frequently Asked Questions

Who can observe the leaked data?

The stale heap contents are exposed to userspace through an NFLOG netlink socket. This is a local issue, reflected by the local attack vector.

What conditions cause data to be leaked?

A leak occurs when the NFULA_PAYLOAD packet-data length is not aligned to four bytes. In that case, one to three trailing netlink alignment-padding bytes are left uninitialized and sent to userspace.

Does exploitation require elevated access or user interaction?

The supplied vector indicates low privileges are required and no user interaction is required. The issue affects confidentiality only; integrity and availability are not affected according to the vector.

What is the remediation?

Apply a kernel update containing the change that replaces manual NFULA_PAYLOAD attribute construction with nla_reserve(), which initializes alignment padding before packet data is copied.

CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

Affected Software

Event History

Frequently Asked Questions

Who can observe the leaked data?

What conditions cause data to be leaked?

Does exploitation require elevated access or user interaction?

What is the remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can observe the leaked data?

What conditions cause data to be leaked?

Does exploitation require elevated access or user interaction?

What is the remediation?