CVE-2026-31428

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

__build_packet_message() manually constructs the NFULA_PAYLOAD netlink

attribute using skb_put() and skb_copy_bits(), bypassing the standard

nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes

are allocated (including NLA alignment padding), only data_len bytes

of actual packet data are copied. The trailing nla_padlen(data_len)

bytes (1-3 when data_len is not 4-byte aligned) are never initialized,

leaking stale heap contents to userspace via the NFLOG netlink socket.

Replace the manual attribute construction with nla_reserve(), which

handles the tailroom check, header setup, and padding zeroing via

__nla_reserve(). The subsequent skb_copy_bits() fills in the payload

data on top of the properly initialized attribute.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References