CVE-2026-31428 Linux CVE debrief

Who should care

Linux distribution maintainers, kernel patch teams, and administrators running kernels with netfilter/NFLOG capability should care, especially on systems that allow unprivileged or low-privileged local users to interact with the affected kernel interfaces.

Technical summary

The vulnerable __build_packet_message() path used skb_put() and skb_copy_bits() to assemble the NFULA_PAYLOAD attribute after allocating nla_total_size(data_len) bytes. That allocation reserves alignment padding, but only data_len bytes of packet content were copied, leaving nla_padlen(data_len) trailing bytes uninitialized. Those bytes could then be disclosed to userspace over the NFLOG netlink socket. The remedy is to use nla_reserve(), which performs the tailroom check, sets up the attribute header, and zeroes padding via __nla_reserve() before skb_copy_bits() fills the payload.

Defensive priority

Medium. The issue is locally reachable, requires low privileges, and involves disclosure of stale kernel heap contents. Patch priority should be elevated on multi-user systems and any host exposing NFLOG-related functionality to local users.

Recommended defensive actions

• Apply the kernel updates that contain the nfnetlink_log fix referenced in the official stable patches.
• Confirm your deployed kernel build is newer than the affected versions listed by NVD for your branch.
• Review whether nfnetlink_log/NFLOG is needed on the system and reduce exposure where it is not required.
• Track vendor kernel advisories for backported fixes if you use a distribution kernel.
• Validate patched systems by confirming the affected netfilter code path now uses nla_reserve() rather than manual attribute construction.

Evidence notes

NVD lists CVE-2026-31428 as published on 2026-04-13 and last modified on 2026-05-20. The supplied description states the bug leaks uninitialized padding from NFULA_PAYLOAD through the NFLOG netlink socket and that the fix switches to nla_reserve()/__nla_reserve() for initialization. NVD also lists the vulnerable Linux kernel version ranges and a CVSS v3.1 vector of AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.