CVE-2026-72072

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the net/mlx5e macsec component. When an offloaded MACsec RX SC is deleted, the macsec del rxsc ctx() function frees the metadata dst object unconditionally, ignoring the reference count. This creates a race condition where the RX datapath in mlx5e macsec offload handle rx skb() may operate on freed memory after obtaining the rx sc pointer. Additionally, mlx5e macsec add rxsc() publishes the sc xarray element via xa alloc() before rx sc->md dst is fully initialized, potentially allowing readers to observe a NULL or uninitialized pointer on weakly-ordered architectures.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.