CVE-2026-72019
Description
In the Linux kernel, the following vulnerability has been resolved: macsec: don't read an unset MAC header in macsec_encrypt() macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC bytes forward and make room for the SecTAG. On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb reaches the macsec ndo_start_xmit() with the MAC header unset, so eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of bounds: a 12-byte heap over-read that is also emitted on the wire as the frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET build flags it as an unset mac header in skb_mac_header(). On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()") for exactly this purpose.
How to fix
- Linux Linuxb6cec6187b8632423cd99a94fd5e5ba165fa2a33, 3adea1b1c04b57e08a5c12a1f42483760581ce61, dc9ffa1905e72f026d080880a2e4cfc42aa91000, f21fa533a3ed15ada74106aac4b9ddd078fc6b7a, e17a42199824973cd8212e95b21ffadf4114a21b, 2cf10d042562283ff4ae97c02d0993d4f1b5ea29, c39087ad0b97fc11a3b058dfc8db9fd370762cb9, f5089008f90c0a7c5520dff3934e0af00adf322d or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < b6cec6187b8632423cd99a94fd5e5ba165fa2a33, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < 3adea1b1c04b57e08a5c12a1f42483760581ce61, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < dc9ffa1905e72f026d080880a2e4cfc42aa91000, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < f21fa533a3ed15ada74106aac4b9ddd078fc6b7a, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < e17a42199824973cd8212e95b21ffadf4114a21b, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < 2cf10d042562283ff4ae97c02d0993d4f1b5ea29, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < c39087ad0b97fc11a3b058dfc8db9fd370762cb9, c09440f7dcb304002dfced8c0fea289eb25f2da0 ≤ v < f5089008f90c0a7c5520dff3934e0af00adf322d, 4.6 | b6cec6187b8632423cd99a94fd5e5ba165fa2a33, 3adea1b1c04b57e08a5c12a1f42483760581ce61, dc9ffa1905e72f026d080880a2e4cfc42aa91000, f21fa533a3ed15ada74106aac4b9ddd078fc6b7a, e17a42199824973cd8212e95b21ffadf4114a21b, 2cf10d042562283ff4ae97c02d0993d4f1b5ea29, c39087ad0b97fc11a3b058dfc8db9fd370762cb9, f5089008f90c0a7c5520dff3934e0af00adf322d |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.