CVE-2026-72019

A flaw was found in the macsec component of the Linux kernel. When processing packets on the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, the macsec_encrypt() function attempts to read an unset Media Access Control (MAC) header. This leads to a 12-byte heap over-read, where sensitive data from memory beyond the intended buffer is accessed. This over-read data is then transmitted on the wire as part of the frame's outer source/destination MAC, potentially leading to information disclosure.

This vulnerability is rated as Moderate impact because triggering it requires local access with specific privileges (such as CAP_NET_RAW) to transmit raw packets over an active MACsec interface. MACsec networking is not configured or enabled by default on standard Red Hat Enterprise Linux installations. Systems are only susceptible if MACsec encryption is actively deployed and local users can craft raw network frames bypassing the packet queuing discipline.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.