The Linux kernel’s netfilter nfnetlink_log subsystem contains a flaw where the NLMSG_DONE message terminator is appended with an uninitialized nfgenmsg payload. This results in leaking four bytes of stale kernel heap memory to userspace clients that receive NFLOG messages. Based on the description, the leaked bytes appear to come from uninitialized payload data, giving an information‑disclosure weakness. Although the leak is small, the exposed data may contain sensitive information that should remain hidden, such as cryptographic keys, process identifiers, or other memory contents.

All Linux kernel implementations that include the nfnetlink_log module are potentially affected. This includes standard distributions that ship the default kernel and any custom kernels that enable NFLOG logging. The vulnerability is inherent to any kernel based on the netfilter infrastructure and does not discriminate by vendor.

The CVSS score is 7.0, and the EPSS score is < 1%, indicating limited publicly known exploitation activity. Attackers likely need to trigger NFLOG messages to receive the NLMSG_DONE payload, which requires either local or network access to the system and the ability to influence netfilter behavior. The likely attack vector is inferred to be the creation of netfilter rules or the sending of packets that activate logging, after which the userspace application receives the uninitialized NLMSG_DONE. The KEV status shows it is not listed, suggesting no confirmed active exploitation yet. Nonetheless, the information disclosure, while small, presents a non‑trivial privacy concern and could facilitate further attacks if the leaked data aids in cracking encryption or manipulating kernel state.