CVE-2026-31428

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlinklog: fix uninitialized padding leak in NFULAPAYLOAD

_buildpacketmessage() manually constructs the NFULAPAYLOAD netlink attribute using skbput() and skbcopybits(), bypassing the standard nlareserve()/nlaput() helpers. While nlatotalsize(datalen) bytes are allocated (including NLA alignment padding), only datalen bytes of actual packet data are copied. The trailing nlapadlen(datalen) bytes (1-3 when datalen is not 4-byte aligned) are never initialized, leaking stale heap contents to userspace via the NFLOG netlink socket.

Replace the manual attribute construction with nla_reserve(), which handles the tailroom check, header setup, and padding zeroing via _nlareserve(). The subsequent skbcopybits() fills in the payload data on top of the properly initialized attribute.