CVE-2026-72049

Received Received - Intake

Information Disclosure in Linux Kernel IEEE 802.15.4 Stack

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which sets no .flags, so generic netlink runs them ungated. The modern nl802154 family admin-gates the equivalent reads via NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev that has an LLSEC key installed; the dump handler writes the raw 16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied verbatim from struct ieee802154_llsec_key.key) into the reply. Recovering the AES key compromises 802.15.4 LLSEC link confidentiality and authenticity, since LLSEC uses CCM* and the same key authenticates and encrypts frames. Impact: any local uid with no capabilities can read the raw 16-byte AES-128 LLSEC key from the kernel keytable on any wpan netdev that has an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY dump on the legacy IEEE802154_NL generic-netlink family. Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the modern nl802154 family exposes their equivalents to unprivileged readers by design (NL802154_CMD_GET_WPAN_PHY and NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged users" annotations).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72049

EUVD

EUVD-2026-59007

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*
linux_kernel	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel allows any local user without special permissions to read raw AES-128 encryption keys used for 802.15.4 wireless security. The issue occurs because legacy netlink operations for dumping security keys lack proper access controls, exposing sensitive cryptographic material that could compromise network confidentiality and integrity.

Detection Guidance

This vulnerability allows local users to dump raw AES-125 LLSEC keys via the legacy IEEE802154_NL generic-netlink family. To detect exploitation attempts, monitor netlink socket activity for unauthorized access to the IEEE802154_NL family or suspicious LLSEC_LIST_KEY dump operations. Check kernel logs for unexpected netlink operations or unauthorized key dumps.

Impact Analysis

If you use Linux systems with 802.15.4 wireless networks (like IoT devices), an attacker with local access could extract encryption keys and decrypt or forge network traffic. This could allow eavesdropping on sensitive communications or injecting malicious data into your network.

Compliance Impact

This vulnerability could lead to unauthorized access to encrypted communications, potentially violating data protection requirements under GDPR (for personal data) or HIPAA (for health information). Organizations may face compliance violations if sensitive data transmitted over 802.15.4 networks is exposed due to this flaw.

Mitigation Strategies

Apply the Linux kernel patch that introduces IEEE802154_DUMP_PRIV() to restrict LLSEC dump operations. Ensure the modern nl802154 family is used instead of the legacy IEEE802154_NL family. Restrict local user access to AF_NETLINK sockets and monitor for unauthorized netlink operations.

Hi! I’m here to help you understand CVE-2026-72049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70