CVE-2026-72019

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.0

Description An issue exists in the macsec encrypt() function where the Ethernet header is read via eth hdr(skb) to move source and destination MAC bytes forward for SecTAG placement. On the AF PACKET SOCK RAW + PACKET QDISC BYPASS transmit path, the socket buffer (skb) reaches macsec ndo start xmit() with the MAC header unset. This causes the read operation to resolve to an out-of-bounds memory location, resulting in a 12-byte heap over-read. The leaked data is subsequently transmitted on the wire as the frame's outer source and destination MAC addresses.

Recommendations Update Linux kernel version 6.0 to a version where the macsec encrypt() function uses skb eth hdr() instead of eth hdr(skb) to correctly handle the L2 header on the TX path.