CVE-2026-72019
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec_encrypt() macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC bytes forward and make room for the SecTAG. On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb reaches the macsec ndo_start_xmit() with the MAC header unset, so eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of bounds: a 12-byte heap over-read that is also emitted on the wire as the frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET build flags it as an unset mac header in skb_mac_header(). On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()") for exactly this purpose.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72019
EUVD
EUVD-2026-58977

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel 6.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a heap out-of-bounds read in the macsec_encrypt() function. When transmitting packets via AF_PACKET SOCK_RAW with PACKET_QDISC_BYPASS, the MAC header is unset, causing eth_hdr(skb) to read from an invalid memory location. This results in a 12-byte heap over-read and exposes the outer source/destination MAC addresses on the wire.

Detection Guidance

This vulnerability may trigger KASAN slab-out-of-bounds warnings or CONFIG_DEBUG_NET errors when transmitting frames via AF_PACKET SOCK_RAW with PACKET_QDISC_BYPASS. Monitor kernel logs for messages like 'slab-out-of-bounds read in macsec_start_xmit' or 'unset mac header in skb_mac_header'.

Impact Analysis

This vulnerability could allow an attacker to read sensitive memory data or manipulate network traffic by injecting crafted packets. Systems using MACsec encryption on affected Linux kernels may experience crashes or information leaks due to the heap over-read.

Mitigation Strategies

Apply the Linux kernel patch that replaces eth_hdr(skb) with skb_eth_hdr() in macsec_encrypt(). Until patched, avoid using AF_PACKET SOCK_RAW with PACKET_QDISC_BYPASS on affected systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72019. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart