Linux Kernel EUVD-2026-27580

The affected component is the netfilter NFLOG subsystem (nfnetlink_log), present in the Linux kernel since v2.6.23 (introduced at commit 29c5d4afba51c71cfeadd3f74f3c42e064483fb0). NFLOG is a kernel-to-userspace logging mechanism used by iptables/nftables rules to forward packet metadata via Netlink. When an NFLOG instance queues multiple messages (inst->qlen > 1), __nfulnl_send() flushes the batch and appends an NLMSG_DONE sentinel. The sentinel is built with nlmsg_put(), which allocates sizeof(struct nfgenmsg) bytes in the Netlink skb payload but applies zero-fill only to trailing alignment padding - not to the struct nfgenmsg body itself. This leaves four bytes of whatever was previously resident at that kernel heap location embedded in the outgoing Netlink message. The correct fix, applied in the patch commits, is to use nfnl_msg_put() with nfnl_fill_hdr() to explicitly initialize the nfgenmsg fields, consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers. CWE classification was not supplied by the reporter, but this is canonically CWE-908 (Use of Uninitialized Resource) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). CPE identifies affected product as cpe:2.3:a:linux:linux:*.