Threats Tagged 'cve-2026-43085'

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.

Multiple vulnerabilities have been identified in the Linux kernel, which is the core component of the Linux operating system. These vulnerabilities are cataloged under CVE-2026-43059 and are associated with the CWE-416 category (Use After Free). The affected products include various Linux distributions such as Amazon Linux 2 and Debian Linux, as well as Google-related Linux environments. No specific technical details or CVSS scores are provided, and there are no known exploits in the wild at this time.