Technical Summary

The Linux kernel PF_KEY export paths used pfkey_sockaddr_size() to reserve sockaddr payload space, causing IPv6 addresses to occupy 32 bytes. However, pfkey_sockaddr_fill() only initialized the first 28 bytes of struct sockaddr_in6, leaving the final 4 bytes uninitialized. This partial initialization affected specific PF_KEY message types (SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, SADB_X_MIGRATE) that append aligned sockaddr payloads with skb_put(). The fix involves clearing the aligned sockaddr tail after pfkey_sockaddr_fill() to ensure full initialization. This vulnerability was addressed in Linux kernel updates included in Ubuntu security notices USN-8567-1 and USN-8574-1. The affected kernel versions are prior to 6.8.0-1061.64~22.04.1 and related versions. The CVSS 3.1 score is 5.5, reflecting a medium severity with local attack vector, low complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or integrity impact, but high availability impact.