The kernel code that builds Netlink attributes for the drop monitor leaves the padding bytes of the NET_DM_ATTR_PAYLOAD attribute uninitialized when the payload length is not a multiple of four. Those padding bytes get copied into the Netlink message that is sent to userspace, allowing a local user who can receive that message to read arbitrary kernel memory fragments. This is an information exposure weakness, as the uninitialized padding leaks kernel internals and may reveal sensitive information.

All Linux kernel versions that do not include the patch for the drop monitor Netlink reporting are affected. The bug was fixed by replacing manual attribute construction with the __nla_reserve() helper, which zeroes padding before copying data. Any system whose kernel still contains the old implementation is vulnerable.

The CVSS score is 5.5, the EPSS score is < 1%, and it is not listed in CISA’s KEV catalog. The information exposed is limited to uninitialized padding, and an attacker must be able to receive Netlink messages originating from the drop monitor. The attack vector is thus local or privileged. Given this limited exposure, the risk is moderate: an attacker could learn kernel memory contents but cannot directly gain control over the kernel or elevate privileges. The vulnerability is most likely exploitable by a local user who can listen to the Netlink socket used by the drop monitor, or by a process with sufficient privileges to do so.