Linux Kernel EUVD-2026-27589

The vulnerability resides in the Linux kernel's XFRM (IPsec transform) subsystem, specifically the xfrm_user interface layer that handles netlink communication of IPsec security association metadata between kernel and userspace. The structure struct xfrm_usersa_id, defined in the kernel UAPI headers, contains a compiler-inserted one-byte alignment padding hole immediately following the proto field. In build_mapping(), this structure is assembled by assigning individual fields without first zeroing the entire allocation, leaving the padding byte populated with whatever residual data occupied that memory location - typically a fragment of kernel stack or slab heap. When the netlink subsystem copies this struct to userspace, the uninitialized padding byte travels with it. CWE-401 (Missing Release of Memory after Effective Lifetime) is the assigned weakness, though CWE-908 (Use of Uninitialized Resource) or CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) more precisely characterize the root cause class - this CWE assignment warrants scrutiny. The vulnerability was introduced at commit 3a2dfbe8acb154905fdc2fd03ec56df42e6c4cc4, traceable to Linux 2.6.29.