VulnerabilityPublished 13 Apr 2026Updated 5 Nov 2026

CVE-2026-31428: Linux kernel · netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in fc961dd7272b5e4a462999635e44a4770d7f2482 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 22:04 UTC

Severity

Unrated

Rated by Threat Radar · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in fc961dd7272b5e4a462999635e44a4770d7f2482, c9f6c51d36482805ac3ffadb9663fe775a13e926, a8365d1064ded323797c5e28e91070c52f44b76c +5

Exploitation evidence

Disclosed: evidence found.
CVE published 13 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ df6fb868d6118686805c2fa566e213a8f31c8e4f, < fc961dd7272b5e4a462999635e44a4770d7f2482	Fixed in fc961dd7272b5e4a462999635e44a4770d7f2482
LinuxLinux	Affected ≥ df6fb868d6118686805c2fa566e213a8f31c8e4f, < c9f6c51d36482805ac3ffadb9663fe775a13e926	Fixed in c9f6c51d36482805ac3ffadb9663fe775a13e926
LinuxLinux	Affected ≥ df6fb868d6118686805c2fa566e213a8f31c8e4f, < a8365d1064ded323797c5e28e91070c52f44b76c	Fixed in a8365d1064ded323797c5e28e91070c52f44b76c
LinuxLinux	Affected ≥ df6fb868d6118686805c2fa566e213a8f31c8e4f, < a2f6ff3444b663d6cfa63eadd61327a18592885a	Fixed in a2f6ff3444b663d6cfa63eadd61327a18592885a
LinuxLinux	Affected ≥ df6fb868d6118686805c2fa566e213a8f31c8e4f, < 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7	Fixed in 52025ebaa29f4eb4ed8bf92ce83a68f24ab7fdf7
LinuxLinux	Affected ≥ df6fb868d6118686805c2fa566e213a8f31c8e4f, < 21d8efda029948d3666b0db5afcc0d36c0984aae	Fixed in 21d8efda029948d3666b0db5afcc0d36c0984aae

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD __build_packet_message() manually constructs the NFULA_PAYLOAD netlink attribute using skb_put() and skb_copy_bits(), bypassing the standard nla_reserve()/nla_put() helpers. While nla_total_size(data_len) bytes are allocated (including NLA alignment padding), only data_len bytes of actual packet data are copied. The trailing nla_padlen(data_len) bytes (1-3 when data_len is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket. Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via __nla_reserve(). The subsequent skb_copy_bits() fills in the payload data on top of the properly initialized attribute.

References

Community reviews

Loading reviews…