CVE-2026-31428

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

__build_packet_message() manually constructs the NFULA_PAYLOAD netlink

attribute using skb_put() and skb_copy_bits(), bypassing the standard

nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes

are allocated (including NLA alignment padding), only data_len bytes

of actual packet data are copied. The trailing nla_padlen(data_len)

bytes (1-3 when data_len is not 4-byte aligned) are never initialized,

leaking stale heap contents to userspace via the NFLOG netlink socket.

Replace the manual attribute construction with nla_reserve(), which

handles the tailroom check, header setup, and padding zeroing via

__nla_reserve(). The subsequent skb_copy_bits() fills in the payload

data on top of the properly initialized attribute.