CVE-2026-64553: Linux Kernel Information Disclosure Flaw

CVE-2026-64553 Overview

CVE-2026-64553 is an information leak vulnerability in the Linux kernel's psample netlink subsystem. The psample module open-codes nla_put() to avoid zeroing memory that will immediately be overwritten with packet data. However, this optimization fails to clear the netlink attribute padding. Each netlink attribute is padded to 4-byte alignment, and when data_len is not divisible by four, uninitialized kernel stack or heap bytes leak to user space through the PSAMPLE_ATTR_DATA attribute.

Critical Impact
Uninitialized kernel memory can leak through netlink multicast messages, exposing potentially sensitive kernel data to any process able to receive psample events.

Affected Products

Linux kernel net/psample subsystem
Distributions shipping affected stable kernels prior to the fixes referenced in the upstream commits
Systems using packet sampling features that rely on psample (for example, TC sample actions and switchdev-based sampling)

Discovery Timeline

2026-07-27 - CVE-2026-64553 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64553

Vulnerability Analysis

The Linux kernel exposes packet sampling telemetry through the psample generic netlink family. Sampled packet data is delivered to user space inside the PSAMPLE_ATTR_DATA netlink attribute. To avoid the cost of zero-initializing the attribute buffer before copying packet bytes into it, psample bypasses the standard nla_put() helper and constructs the attribute inline. This shortcut is safe only if every byte in the resulting attribute is written before the message is delivered.

Netlink attributes must be padded to a 4-byte boundary. When the sampled packet length is not a multiple of four, one to three trailing padding bytes remain uninitialized. Because the code path skips the memset that nla_put() normally performs, those padding bytes retain whatever content previously occupied the underlying skb memory. A receiver subscribed to the psample multicast group observes these bytes as part of the delivered attribute payload, producing a kernel information disclosure classified under [CWE-908] Use of Uninitialized Resource.

Root Cause

The root cause is a missing pad-clear step in the hand-rolled attribute construction inside psample_send_sample() (and related code paths referenced in the upstream commits). The optimization assumes packet data fills the attribute, but the padding region between the packet tail and the next 4-byte boundary is never written.

Attack Vector

Exploitation requires the ability to receive psample netlink multicast messages, which typically requires CAP_NET_ADMIN in the relevant network namespace. A local unprivileged attacker cannot trigger the leak directly, but a compromised or lower-privileged administrative process can harvest small fragments of adjacent kernel memory across many sampled packets. Repeated sampling can be used to reconstruct sensitive state over time.

No public exploit code is available. Technical details are captured in the upstream fixes: Kernel Git Commit 0d3ea2c, Kernel Git Commit 48930f6, Kernel Git Commit 794a0d8, and Kernel Git Commit e2fa322.

Detection Methods for CVE-2026-64553

Indicators of Compromise

No network-visible IOCs exist for this vulnerability. The leak occurs entirely inside kernel-to-user netlink messages.
Unexpected non-root processes joining the psample generic netlink multicast group can indicate reconnaissance activity.

Detection Strategies

Inventory kernel versions across the fleet and compare against the fixed stable branches referenced in the upstream commits.
Audit which processes hold CAP_NET_ADMIN and which subscribe to psample netlink events using ss -f netlink or eBPF-based netlink tracing.
Review TC (tc filter ... action sample) and switchdev configurations to identify hosts where psample is actively producing traffic.

Monitoring Recommendations

Monitor loads of the psample module on hosts that do not require packet sampling and alert on unexpected activations.
Log changes to CAP_NET_ADMIN grants and container capability sets, since those are prerequisites for consuming the leaked data.
Track kernel package versions through configuration management and flag hosts running unpatched builds identified as affected.

How to Mitigate CVE-2026-64553

Immediate Actions Required

Apply the latest stable kernel updates from your Linux distribution that include the psample pad-clearing fix.
Where patching is delayed, unload the psample module on hosts that do not require packet sampling using rmmod psample and blacklist it.
Restrict CAP_NET_ADMIN in containers and unprivileged workloads so untrusted processes cannot subscribe to psample multicast events.

Patch Information

The upstream fix adds explicit clearing of the netlink attribute padding bytes before delivery. The change is available across multiple stable branches through the following commits: 0d3ea2c, 48930f6, 794a0d8, 7fe7e69, a6cfb92, aedd02a, befe1eb, and e2fa322. Rebuild and reboot into the patched kernel to apply.

Workarounds

Blacklist the psample module on systems that do not use TC sampling or switchdev sampling to eliminate the attack surface entirely.
Remove CAP_NET_ADMIN from container profiles and seccomp/AppArmor policies where it is not required.
Use Linux namespaces to isolate workloads that must run with CAP_NET_ADMIN so they cannot observe host-level sampled traffic.

bash

# Blacklist the psample module until the kernel is patched
echo 'blacklist psample' | sudo tee /etc/modprobe.d/blacklist-psample.conf
sudo rmmod psample 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -w psample && echo "still loaded" || echo "not loaded"