CVE-2026-72019: macsec: don't read an unset MAC header in macsec_encrypt()
In the Linux kernel, the following vulnerability has been resolved:
macsec: don't read an unset MAC header in macsecencrypt()
macsecencrypt() reads the Ethernet header via ethhdr(skb) (skb->head + skb->macheader) to memmove() the 12 source/destination MAC bytes forward and make room for the SecTAG.
On the AFPACKET SOCKRAW + PACKETQDISCBYPASS transmit path the skb reaches the macsec ndostartxmit() with the MAC header unset, so ethhdr(skb) resolves to skb->head + (u16)~0 and the read is out of bounds: a 12-byte heap over-read that is also emitted on the wire as the frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds read in macsecstartxmit() on 6.0; on current mainline a CONFIGDEBUGNET build flags it as an unset mac header in skbmacheader().
On the TX path the L2 header is at skb->data, so use skbethhdr(), added by commit 96cc4b69581d ("macvlan: do not assume macheader is set in macvlanbroadcast()") for exactly this purpose.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72019?
CVE-2026-72019 has a risk score of 37, indicating a moderate level of severity.
How do I fix CVE-2026-72019?
To fix CVE-2026-72019, ensure your Linux kernel is updated to the latest version where the vulnerability has been patched.
What does CVE-2026-72019 affect?
CVE-2026-72019 affects the macsec_encrypt function within the Linux kernel.
What is the nature of CVE-2026-72019?
CVE-2026-72019 involves the reading of an unset MAC header in the macsec_encrypt function.
When was CVE-2026-72019 published?
CVE-2026-72019 was published on August 15, 2026.