CVE-2026-31428: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-13 · updated 2026-10-15
Weakness: CWE-908

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket. Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute.

Affected products

Linux kernel: from 2.6.24 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.168; from 6.2 before 6.6.131; from 6.7 before 6.12.80; from 6.13 before 6.18.21 — fixed in 5.10.253, 5.15.203, 6.1.168, 6.12.80, 6.18.21, 6.19.11

How to fix

Upgrade to a fixed version: Linux kernel 5.10.253, 5.15.203, 6.1.168, 6.12.80. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31428 or the next vulnerability affects your stack