CVE-2026-43085
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
36/100
Published: 2026-05-06
Modified: 2026-11-10
First seen: 2026-11-06
Status: active
Attack Surface
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Local
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
None
I:
None
A:
High
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.
Affected Software (27)
| Vendor | Product | Version |
|---|---|---|
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 296f18e1c3a87c915a92ed27832d5040a22d1072 |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 9e2182865de781c41ab16b7985e9d26dcefea867 |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 57cc509d82b46150a11dcecc8b25eaa177eda34d |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 368c22aea490f6f50df831b4f9e3623787686c5b |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < d1399632ba255d2e02c757af5d9f5d9279ce168c |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < d552bcfca323d175664d7444989b04f55666978a |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 15d209bccf9273b4a8b4e579ba0e92d065b6ec8c |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 1f3083aec8836213da441270cdb1ab612dd82cf4 |
| Linux | Linux | 2.6.23 |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 296f18e1c3a87c915a92ed27832d5040a22d1072 |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 9e2182865de781c41ab16b7985e9d26dcefea867 |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 57cc509d82b46150a11dcecc8b25eaa177eda34d |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 368c22aea490f6f50df831b4f9e3623787686c5b |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < d1399632ba255d2e02c757af5d9f5d9279ce168c |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < d552bcfca323d175664d7444989b04f55666978a |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 15d209bccf9273b4a8b4e579ba0e92d065b6ec8c |
| Linux | Linux | 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 < 1f3083aec8836213da441270cdb1ab612dd82cf4 |
| Linux | Linux | 2.6.23 |
| linux | linux_kernel | 2.6.23.1 – 5.10.258 |
| linux | linux_kernel | 2.6.23 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | 7.0 |