Skip to main content

Linux Kernel CVE-2026-72019

| EUVDEUVD-2026-58977 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-593p-5684-69pq
Buffer Overflow Linux Red Hat Suse
7.3
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
7.3 HIGH

Local vector required for AF_PACKET socket; PR:L reflects CAP_NET_RAW; C:H for heap disclosure; A:H for potential kernel panic.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
4.4 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 12:45 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.3 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.3
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

macsec: don't read an unset MAC header in macsec_encrypt()

macsec_encrypt() reads the Ethernet header via eth_hdr(skb) (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC bytes forward and make room for the SecTAG.

On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb reaches the macsec ndo_start_xmit() with the MAC header unset, so eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of bounds: a 12-byte heap over-read that is also emitted on the wire as the frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET build flags it as an unset mac header in skb_mac_header().

On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in macvlan_broadcast()") for exactly this purpose.

AnalysisAI

Heap out-of-bounds read in the Linux kernel MACsec subsystem (macsec_encrypt()) allows a local attacker with CAP_NET_RAW capability to leak 12 bytes of kernel heap memory and emit that raw heap content onto the wire as a malformed Ethernet frame, with additional potential for kernel destabilization. The flaw is triggered exclusively via the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, where the socket buffer arrives at macsec_start_xmit() with skb->mac_header unset, resolving eth_hdr(skb) to skb->head + 65535 - far outside valid headroom. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) reflects low exploitation probability; patches have been backported across all active stable kernel series.

Technical ContextAI

MACsec (IEEE 802.1AE) is a Layer 2 encryption protocol implemented in the Linux kernel (drivers/net/macsec.c) since version 4.6. The vulnerability is rooted in macsec_encrypt() calling eth_hdr(skb) - which expands to skb->head + skb->mac_header - to read 12 bytes of source/destination MAC address for repositioning ahead of the SecTAG insertion. On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS TX path, the kernel does not set skb->mac_header before forwarding the skb to the MACsec driver, leaving it at its uninitialized sentinel value of (u16)~0 (65535). The resulting pointer arithmetic yields a read 65535 bytes into skb->head, well outside the allocated slab object. KASAN detects this as a slab-out-of-bounds read; CONFIG_DEBUG_NET builds flag it as an unset mac_header via skb_mac_header(). The fix, referenced in the upstream commit history, replaces eth_hdr() with skb_eth_hdr() - which correctly reads from skb->data on the TX path - mirroring the approach used for an analogous macvlan fix in commit 96cc4b69581d. No CWE is formally assigned, but this is structurally a heap buffer over-read (CWE-125).

RemediationAI

Upgrade to a patched kernel version corresponding to your stable branch: 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc3 or later. Distribution-specific kernel updates from vendors tracking these stable branches (e.g., RHEL, Ubuntu, Debian, SUSE) should incorporate the same fix commits. For systems that cannot be patched immediately, the most effective compensating control is to deconfigure or remove MACsec interfaces (ip link delete <macsec_if>) if MACsec is not operationally required - this completely eliminates the vulnerable code path with no security trade-off beyond losing MACsec encryption. Where MACsec must remain active, restrict CAP_NET_RAW capability via seccomp-bpf profiles, container runtime policy (e.g., drop NET_RAW in Docker/Kubernetes pod specs), or SELinux/AppArmor MAC policy to prevent unprivileged processes from opening AF_PACKET sockets; note this may break legitimate packet capture tools. The NVD advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-72019.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72019 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy