CVE-2026-43085

Vulnerability

In the Linux kernel's netfilter subsystem, the nfnetlink_log module is used to send logging messages to userspace via netlink. When multiple NFLOG messages are batched (inst->qlen > 1), the function __nfulnl_send() appends an NLMSG_DONE terminator using nlmsg_put(). The helper nlmsg_put() only zeroes alignment padding after the payload, not the payload itself, leaving the struct nfgenmsg bytes uninitialized. As a result, four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body.

Exploitation

An attacker capable of triggering netfilter logging events (e.g., via firewall rules or packet processing) can cause the batching condition to occur. No special privileges beyond the ability to interact with nfnetlink are required; the leak occurs automatically when the kernel sends batched log messages. The uninitialized data is sent directly to the receiving userspace application, making the leak trivially observable.

Impact

The vulnerability leads to an information disclosure of up to 4 bytes of kernel heap memory. While the leak is small, it may reveal sensitive information such as kernel pointers or other data used to defeat kernel address space layout randomization (KASLR) or to aid in further exploitation.

Mitigation

The issue is fixed in Linux kernel stable releases via commits [1][2][3][4]. Users should update their kernels to include these patches. No workarounds are available; the fix ensures that the NLMSG_DONE terminator is built with nfnl_msg_put(), which properly initializes the nfgenmsg structure.