CVE-2026-43085
5.5 MEDIUMIn the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminat...
Published: 2026-05-06 · Last updated: 2026-06-01
Severity and scoring
- CVSS
- 5.5 MEDIUM
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
| Vendor | Product |
|---|---|
| linux | linux_kernel |
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-43085
- [Patch]https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8c
- [Patch]https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4
- [Patch]https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072
- [Patch]https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5b
- [Patch]https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34d
- [Patch]https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867
- [Patch]https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168c
- [Patch]https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978a
Related CVEs
Same vendor
- CVE-2026-46273 — In the Linux kernel, the following vulnerability has been resolved: ibmveth: Disable GSO for packets with small MSS Some physical adapt... (8.6 HIGH)
- CVE-2026-46272 — In the Linux kernel, the following vulnerability has been resolved: coresight: tmc-etr: Fix race condition between sysfs and perf mode ... (4.7 MEDIUM)
- CVE-2026-46271 — In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: do WoW offloads only on primary link In case of multi... (7.8 HIGH)
- CVE-2026-46270 — In the Linux kernel, the following vulnerability has been resolved: power: supply: rt9455: Fix use-after-free in power_supply_changed() ... (8.4 HIGH)
- CVE-2026-46269 — In the Linux kernel, the following vulnerability has been resolved: pinctrl: canaan: k230: Fix NULL pointer dereference when parsing dev... (5.5 MEDIUM)