Linux Kernel EUVD-2026-27586

The vulnerability exists in the Linux kernel's PF_KEY (AF_KEY socket family) implementation used for IPsec key management. The pfkey_sockaddr_fill() function initializes only 28 bytes of struct sockaddr_in6 (32 bytes when aligned), leaving 4 padding bytes uninitialized. PF_KEY export paths allocate space via pfkey_sockaddr_size() which accounts for the full 32-byte alignment, but initialization is incomplete, exposing kernel stack memory. Three message types (SADB_ACQUIRE, SADB_X_NAT_T_NEW_MAPPING, SADB_X_MIGRATE) append aligned sockaddr payloads using plain skb_put(), leaking the uninitialized tail. State and policy dump builders already zero entire message buffers, so they are unaffected. The root cause is the mismatch between reserved size and initialized size when exporting sockaddr structures to userspace IPsec applications.