psample_sample_packet() open-codes the PSAMPLE_ATTR_DATA attribute. It reserves nla_total_size(data_len) bytes via skb_put() but only writes NLA_HDRLEN + data_len of them, so when data_len is not a multiple of 4 the up to 3 trailing alignment-padding bytes are left uninitialised. The skb head comes from kmalloc_reserve(), which does not zero memory, so those bytes hold stale slab contents that are then broadcast to all listeners on the PSAMPLE_NL_MCGRP_SAMPLE multicast group, leaking kernel heap memory to userspace. Zero the trailing padding after the payload copy. Fixes: 6ae0a6286171 ("net: Introduce psample, a new genetlink channel for packet sampling") Reported-by: Weiming Shi Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei --- net/psample/psample.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/psample/psample.c b/net/psample/psample.c index 7763662036fb..26220dca0f12 100644 --- a/net/psample/psample.c +++ b/net/psample/psample.c @@ -485,6 +485,9 @@ void psample_sample_packet(struct psample_group *group, if (skb_copy_bits(skb, 0, nla_data(nla), data_len)) goto error; + + memset((unsigned char *)nla + nla->nla_len, 0, + nla_padlen(data_len)); } #ifdef CONFIG_INET -- 2.43.0