CVE-2026-31416

Vulnerability

The Linux kernel's nfnetlink_log module, part of the netfilter subsystem, contains a flaw in the calculation of the NLMSG_DONE message size. The NLMSG_DONE message is used to signal the end of a netlink multipart message. The bug causes the size calculation to omit the netlink header, resulting in a message that is too small.

Exploitation

When the kernel sends a completed netlink log message to userspace, the incorrectly sized NLMSG_DONE message triggers a WARN splat (kernel warning) and the message is dropped. An attacker can trigger this by generating network traffic that is logged by nfnetlink_log, causing repeated warnings and loss of log messages. No authentication or special privileges are required to trigger the condition, as it occurs during normal packet logging operations.

Impact

The impact is limited to kernel warning messages and dropped netlink messages. There is no risk of code execution, privilege escalation, or data corruption. However, the warning messages may cause unwanted log noise and the loss of log events could impede network monitoring.

Mitigation

Patches have been applied to the Linux kernel stable tree [1]. Users should update their kernel to a version containing this fix to avoid the warning and ensure proper log delivery.