Linux Kernel Vulnerability in Netfilter by Vendor

CVE-2026-43085

What is CVE-2026-43085?

The Linux kernel has a vulnerability within the netfilter component, specifically related to the nfnetlink_log functionality. When processing multiple NFLOG messages, the __nfulnl_send() function fails to initialize the nfgenmsg payload in the NLMSG_DONE terminator. This oversight allows remnants of stale kernel heap data to be exposed to userspace, potentially resulting in data leakage. To mitigate this, the nfnl_msg_put() function should be employed to construct the NLMSG_DONE terminator correctly. This ensures proper initialization of the nfgenmsg payload, aligning with secure coding practices already established in other kernel messaging routines.

References