Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to view sensitive information from the system's memory. The issue exists in the Netfilter component, which handles network traffic logging. By exploiting this flaw, an attacker could potentially access fragments of data belonging to other processes or the operating system itself, which may include passwords or encryption keys.
Technical details
An information leak exists in the nfnetlink_log component of the Linux kernel due to uninitialized padding in the NFULA_PAYLOAD attribute. The function __build_packet_message() manually constructs netlink attributes using skb_put() and skb_copy_bits() instead of standard helpers, failing to initialize 1-3 bytes of alignment padding when the payload length is not 4-byte aligned. A local attacker with access to the NFLOG netlink socket can read these uninitialized bytes, which contain stale heap contents. The issue has been resolved by replacing manual construction with nla_reserve(), which ensures proper padding zeroing.
Affected products
- Linux Linux Kernel 2.6.24 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, 6.19 to 6.19.11
Timeline
- 2026-03-25: other: Patch authored
- 2026-04-13: disclosed: CVE published
- 2026-04-18: patched: Stable kernel updates released
References
- https://git.kernel.org/stable/c/21d8efda029948d3666b0db5afcc0d36c0984aae
- https://git.kernel.org/stable/c/52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7
- https://git.kernel.org/stable/c/7eff72968161fb8ddb26113344de3b92fb7d7ef5
- https://git.kernel.org/stable/c/7f3e5d72455936f42709116fabeca3bb216cda62
- https://git.kernel.org/stable/c/a2f6ff3444b663d6cfa63eadd61327a18592885a
- https://git.kernel.org/stable/c/a8365d1064ded323797c5e28e91070c52f44b76c
- https://git.kernel.org/stable/c/c9f6c51d36482805ac3ffadb9663fe775a13e926