CVE-2026-72019
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, in the macsec_encrypt() function, an unset MAC header is read, leading to an out-of-bounds read (12-byte over-read) and data leak to the wire. The fix uses skb_eth_hdr() instead of eth_hdr() to correctly obtain the L2 header.
Risk Assessment
Risk of kernel memory data leak to the network and potential system crashes due to out-of-bounds read.
Recommendation
It is recommended to update the Linux kernel to a patched version and avoid using PACKET_QDISC_BYPASS with MACsec.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec_encrypt() macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC bytes forward and make room for the SecTAG. On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb reaches the macsec ndo_start_xmit() with the MAC header unset, so eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of bounds: a 12-byte heap over-read that is also emitted on the wire as the frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET build flags it as an unset mac header in skb_mac_header(). On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()") for exactly this purpose.