CVE-2026-31428

netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

State: Published
Severity: Not scored
Published: Apr 13, 2026
Updated: Oct 15, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

__build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.

Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	df6fb868d6118686805c2fa566e213a8f31c8e4f to before 7f3e5d72455936f42709116fabeca3bb216cda62Affected df6fb868d6118686805c2fa566e213a8f31c8e4f to before 21d8efda029948d3666b0db5afcc0d36c0984aaeAffected df6fb868d6118686805c2fa566e213a8f31c8e4f to before fc961dd7272b5e4a462999635e44a4770d7f2482Affected df6fb868d6118686805c2fa566e213a8f31c8e4f to before a8365d1064ded323797c5e28e91070c52f44b76cAffected df6fb868d6118686805c2fa566e213a8f31c8e4f to before a2f6ff3444b663d6cfa63eadd61327a18592885aAffected df6fb868d6118686805c2fa566e213a8f31c8e4f to before c9f6c51d36482805ac3ffadb9663fe775a13e926Affected df6fb868d6118686805c2fa566e213a8f31c8e4f to before 7eff72968161fb8ddb26113344de3b92fb7d7ef5Affected df6fb868d6118686805c2fa566e213a8f31c8e4f to before 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7Affected
LinuxLinux	2.6.24Affected before 2.6.24Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.80 through 6.12.Not affected 6.18.21 through 6.18.Not affected 6.19.11 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

df6fb868d6118686805c2fa566e213a8f31c8e4f to before 7f3e5d72455936f42709116fabeca3bb216cda62Affected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before 21d8efda029948d3666b0db5afcc0d36c0984aaeAffected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before fc961dd7272b5e4a462999635e44a4770d7f2482Affected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before a8365d1064ded323797c5e28e91070c52f44b76cAffected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before a2f6ff3444b663d6cfa63eadd61327a18592885aAffected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before c9f6c51d36482805ac3ffadb9663fe775a13e926Affected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before 7eff72968161fb8ddb26113344de3b92fb7d7ef5Affected
df6fb868d6118686805c2fa566e213a8f31c8e4f to before 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7Affected

LinuxLinux

2.6.24Affected
before 2.6.24Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.80 through 6.12.*Not affected
6.18.21 through 6.18.*Not affected
6.19.11 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.