Executive brief
A vulnerability in the Linux kernel's packet sampling component could allow a local user to view small amounts of sensitive kernel memory. The issue occurs because the system fails to properly clear internal data buffers before sending network information to userspace. While the amount of leaked data is small, it could potentially be used by an attacker to bypass security protections or gain insights into the system's internal operations.
Technical details
An information leak exists in the psample netlink channel (net/psample/psample.c) within the Linux kernel. The vulnerability is caused by 'open coding' the nla_put() functionality to optimize performance, which inadvertently skipped clearing the 4-byte alignment padding for the PSAMPLE_ATTR_DATA attribute. When the packet data length is not a multiple of 4 bytes, the remaining bytes in the padding contain residual kernel memory. A local attacker with access to the netlink socket can capture these samples and read the uninitialized bytes. The issue has been resolved by explicitly zeroing the padding using skb_put_zero().
Affected products
- Linux Linux 4.11 to 6.10.y
Timeline
- 2026-06-15: disclosed: Initial patch authored by Jakub Kicinski
- 2026-07-24: patched: Patch committed to stable trees
- 2026-07-27: advisory: CVE published to NVD
References
- https://git.kernel.org/stable/c/0d3ea2ccddda442077fc44f11d873209c97ec50b
- https://git.kernel.org/stable/c/48930f6c59fd0056c2de46ce52bfe27d9c9e5eb6
- https://git.kernel.org/stable/c/794a0d8bdbb39e083ed42caccb86d687a9b53570
- https://git.kernel.org/stable/c/7fe7e6949964aa8ee6305f09db2dc9eede977bb3
- https://git.kernel.org/stable/c/a6cfb924ad74efce254e99c197d2e3863de70868
- https://git.kernel.org/stable/c/aedd02af1f8b0bceb7f42f5a21c41634ca9ed390
- https://git.kernel.org/stable/c/befe1ebe7fc2c65c80074bc34ceeb0a721ed3cd2