CVE-2026-64553: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64553 is an information disclosure vulnerability in the Linux kernel's psample networking module, specifically in the handling of PSAMPLE_ATTR_DATA netlink attributes. The flaw causes uninitialized kernel memory to be leaked via uncleared padding bytes in netlink attribute construction. It affects Linux kernel versions from 4.11 up to (but not including) the fixed stable releases. Fixed versions include 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc1. The vulnerability was disclosed on July 27, 2026, and carries an estimated CVSS severity of Medium (GitHub Advisory, Feedly).

The root cause is an information exposure through uninitialized memory (CWE-200 / CWE-908). The psample module open-codes nla_put() to avoid zeroing a buffer before writing packet data into it — an optimization to prevent unnecessary memory writes. However, this custom implementation omits the required clearing of the netlink attribute's padding bytes. Since netlink attributes are aligned to 4-byte boundaries and packet data (data_len) may not be a multiple of 4 bytes, the trailing 1–3 padding bytes remain uninitialized and contain stale kernel memory contents, which are then transmitted to userspace via the netlink socket (GitHub Advisory). No public proof-of-concept exploit code is known at this time.

Successful exploitation allows a local user with access to packet sampling functionality (via the psample subsystem) to read uninitialized kernel memory from the padding area of sampled packet netlink messages, potentially disclosing sensitive kernel state such as pointers, stack data, or other in-memory artifacts. This is a confidentiality-only impact — integrity and availability are not affected. The leaked data could theoretically assist in bypassing kernel ASLR or other memory-layout-dependent protections in a chained attack scenario (Feedly, GitHub Advisory).

Update the Linux kernel to a patched stable release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 or later (GitHub Advisory). As a workaround where immediate patching is not feasible, restrict access to packet sampling functionality by limiting CAP_NET_ADMIN capabilities to trusted users and processes only. Disabling or unloading the psample kernel module (if not required) can also eliminate the attack surface.