CVE-2026-31428

Vulnerability

Overview

A medium-severity information-disclosure vulnerability (CVSS 5.5) exists in the Linux kernel's netfilter subsystem, specifically in the nfnetlink_log module. The function __build_packet_message() constructs the NFULA_PAYLOAD netlink attribute manually using skb_put() and skb_copy_bits() instead of the proper nla_reserve()/nla_put() helpers. While the total allocated size includes the NLA alignment padding, only the actual data bytes are copied; the trailing padding bytes (1 to 3 bytes when the payload length is not a multiple of 4) remain uninitialized, disclosing stale heap content to any process able to read from the NFLOG netlink socket [1].

Attack

Vector

An attacker who can receive netlink messages from the NFLOG socket family—usually a local user with CAP_NET_ADMIN capability or root—can observe the leaked data. No remote network access is required; the attack surface is local. The leak occurs every time a packet log message is built where the captured payload length is not 4-byte aligned. Because the missing initialization is in the netfilter logging path, any packet that triggers a log entry (e.g., through iptables or nftables rules) can carry the stale bytes [1].

Impact

A local attacker can retrieve up to three bytes of uninitialized kernel heap memory per monitored packet. This may reveal sensitive kernel pointers, slab metadata, or fragments of previous allocations, breaking kernel address-space layout randomization (KASLR) or enabling further exploitation. The information disclosure is limited in size per event but can be repeated over many logged packets to accumulate data [1].

Mitigation

The fix replaces the manual attribute construction with nla_reserve(), which internally zeroes the padding via __nla_reserve(). The upstream commit has been applied to stable kernel branches; system administrators should apply the latest kernel updates for their distribution. No workaround exists short of disabling netlink logging or restricting access to the NFLOG socket [1].