PT-2026-32354 · Linux · Linux Kernel

Published 2026-04-13 · Updated 2026-05-03 · CVE-2026-31428

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw in the netfilter nfnetlink log component allows the leak of stale heap contents to userspace via the NFLOG netlink socket. The function build packet message() manually constructs the 'NFULA PAYLOAD' netlink attribute, but fails to initialize the trailing padding bytes when the data length is not 4-byte aligned.

Recommendations Replace the manual attribute construction in build packet message() with nla reserve() to ensure proper padding zeroing.

Fix

Use of Uninitialized Resource

Weakness Enumeration

CWE-908

Related Identifiers

CVE-2026-31428

ECHO-9975-CA56-9ED9

OESA-2026-2172

OESA-2026-2173

OESA-2026-2176

Affected Products

Linux Kernel

References · 47

• https://nvd.nist.gov/vuln/detail/CVE-2025-71089 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23442 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23455 · Security Note
• https://cve.org/CVERecord?id=CVE-2026-31428 · Security Note
• https://git.kernel.org/stable/c/7eff72968161fb8ddb26113344de3b92fb7d7ef5 · Patch
• https://git.kernel.org/stable/c/52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7 · Patch
• https://osv.dev/vulnerability/OESA-2026-2172 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27558 · Security Note
• https://git.kernel.org/stable/c/c9f6c51d36482805ac3ffadb9663fe775a13e926 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23452 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31416 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23447 · Security Note
• https://git.kernel.org/stable/c/a8365d1064ded323797c5e28e91070c52f44b76c · Patch
• https://ubuntu.com/security/CVE-2026-31428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23449 · Security Note