--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -594,6 +594,13 @@
 		return (NULL);
 	m->m_len = CMSG_SPACE(size);
 	cp = mtod(m, struct cmsghdr *);
+	/*
+	 * Zero the whole control message (header + data + tail padding)
+	 * so the alignment padding between CMSG_LEN(size) and
+	 * CMSG_SPACE(size) cannot disclose stale mbuf heap contents via
+	 * recvmsg(2) copyout of m_len bytes (sys_recvmsg).
+	 */
+	bzero(cp, CMSG_SPACE(size));
 	if (p != NULL)
 		memcpy(CMSG_DATA(cp), p, size);
 	cp->cmsg_len = CMSG_LEN(size);