Medium 5.5Published May 6, 2026

CVE-2026-43085netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator

Updated under an hour ago (Oct 27, 2026, 6:40 PM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before 296f18e1c3a87c915a92ed27832d5040a22d1072; 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 builds before 9e2182865de781c41ab16b7985e9d26dcefea867; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before 57cc509d82b46150a11dcecc8b25eaa177eda34d; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before 368c22aea490f6f50df831b4f9e3623787686c5b; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before d1399632ba255d2e02c757af5d9f5d9279ce168c; from 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 before d552bcfca323d175664d7444989b04f55666978a; 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 builds before 15d209bccf9273b4a8b4e579ba0e92d065b6ec8c; 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 builds before 1f3083aec8836213da441270cdb1ab612dd82cf4	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 2.6.23.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 2.6.23; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/296f18e1c3a87c915a92ed27832d5040a22d1072	patch
https://git.kernel.org/stable/c/9e2182865de781c41ab16b7985e9d26dcefea867	patch
https://git.kernel.org/stable/c/57cc509d82b46150a11dcecc8b25eaa177eda34d	patch
https://git.kernel.org/stable/c/368c22aea490f6f50df831b4f9e3623787686c5b	patch
https://git.kernel.org/stable/c/d1399632ba255d2e02c757af5d9f5d9279ce168c	patch
https://git.kernel.org/stable/c/d552bcfca323d175664d7444989b04f55666978a	patch
https://git.kernel.org/stable/c/15d209bccf9273b4a8b4e579ba0e92d065b6ec8c	patch
https://git.kernel.org/stable/c/1f3083aec8836213da441270cdb1ab612dd82cf4	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.