[PATCH] audit: use copied skb length in kauditd_send_multicast_skb()

From: Ricardo Robaina

Date: Mon Aug 10 2026 - 09:09:22 EST


The netlink header's nlmsg_len was being set using the original skb
instead of the local copy passed to nlmsg_multicast().

While skb->len and copy->len are identical at this point following
skb_copy(), it is conceptually cleaner and safer to use the length
of the skb being actively modified and sent. Thus, this is a minor
cleanup only, no functional change expected.

Signed-off-by: Ricardo Robaina <rrobaina@xxxxxxxxxx>
---
kernel/audit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/audit.c b/kernel/audit.c
index 9412af9144bc..631d6d4a23cf 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -871,7 +871,7 @@ static void kauditd_send_multicast_skb(struct sk_buff *skb)
if (!copy)
return;
nlh = nlmsg_hdr(copy);
- nlh->nlmsg_len = skb->len;
+ nlh->nlmsg_len = copy->len;

nlmsg_multicast(sock, copy, 0, AUDIT_NLGRP_READLOG, GFP_KERNEL);
}
--
2.55.0