Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV L L L N U N N H 5.5 .0017 5.3 —
AFFECTED Product Versions Fixed Linux 29c5d4afba51c71cfeadd3f74f3c42e064483fb0 – — Linux 2.6.23 – 5.10.258
TIMELINE May 1 Reserved by Linux May 6 Published (CNA: Linux) Sep 8 ENRICHED — CVE-2026-43085 (Linux). Received CVSS 5.5 and CPE data from NVD.
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator When batching multiple NFLOG messages (inst->qlen > 1), __nfulnl_send() appends an NLMSG_DONE terminator with sizeof(struct nfgenmsg) payload via nlmsg_put(), but never initializes the nfgenmsg bytes. The nlmsg_put() helper only zeroes alignment padding after the payload, not the payload itself, so four bytes of stale kernel heap data are leaked to userspace in the NLMSG_DONE message body. Use nfnl_msg_put() to build the NLMSG_DONE terminator, which initializes the nfgenmsg payload via nfnl_fill_hdr(), consistent with how __build_packet_message() already constructs NFULNL_MSG_PACKET headers.
| Date | Event | Detail |
|---|---|---|
| May 1, 2026 | Reserved | Reserved by Linux |
| May 6, 2026 | Published | Published (CNA: Linux) |
| September 8, 2026 | ENRICHED | ENRICHED — CVE-2026-43085 (Linux). Received CVSS 5.5 and CPE data from NVD. |
Authoritative record: CVE-2026-43085 at cve.org
Vendors: linux
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43085 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
