PT-2026-37395 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43085

NVD

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink log: initialize nfgenmsg in NLMSG DONE terminator

When batching multiple NFLOG messages (inst->qlen > 1), nfulnl send() appends an NLMSG DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg put(), but never initializes the nfgenmsg bytes. The nlmsg put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG DONE message body.

Use nfnl msg put() to build the NLMSG DONE terminator, which initializes the nfgenmsg payload via nfnl fill hdr(), consistent with how build packet message() already constructs NFULNL MSG PACKET headers.

Related Identifiers

CVE-2026-43085

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43085 · Security Note
• https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5b · Note
• https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168c · Note
• https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8c · Note
• https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978a · Note
• https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4 · Note