CVE-2026-43085netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
Updated under an hour ago ()
Does this affect you?
It affects Linux and 5 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.
- CVSS
- 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before 296f18e1c3a87c915a92ed27832d5040a22d1072; 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 builds before 9e2182865de781c41ab16b7985e9d26dcefea867; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before 57cc509d82b46150a11dcecc8b25eaa177eda34d; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before 368c22aea490f6f50df831b4f9e3623787686c5b; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before d1399632ba255d2e02c757af5d9f5d9279ce168c; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before d552bcfca323d175664d7444989b04f55666978a; 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 builds before 15d209bccf9273b4a8b4e579ba0e92d065b6ec8c; 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 builds before 1f3083aec8836213da441270cdb1ab612dd82cf4 | CNA record |
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name) | all versions | CISA ADP |
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name) | from V3.1.6 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 2.6.23.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 2.6.23; and 7 more ranges | NVD |
References
- https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072patch
- https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867patch
- https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34dpatch
- https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5bpatch
- https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168cpatch
- https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978apatch
- https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8cpatch
- https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4patch
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-457936.html
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.