CVE-2026-72049

A flaw was found in the Linux kernel's IEEE 802.15.4 (LLSEC) subsystem. A local user without special privileges could exploit ungated legacy dump operations to read raw 16-byte AES-128 keys from the kernel keytable on wireless personal area network (WPAN) devices. This information disclosure compromises the confidentiality and authenticity of the 802.15.4 LLSEC link.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If IEEE 802.15.4 networking functionality is not required, prevent the ieee802154 kernel module from loading:

1. Add a modprobe configuration to disable loading the module:

echo "install ieee802154 /bin/true" >> /etc/modprobe.d/disable-ieee802154.conf

2. If the module is already loaded, attempt to remove it:

modprobe -r ieee802154

Caveats: Disabling this module prevents the system from interacting with IEEE 802.15.4 WPAN devices. If the module is actively in use by running services or hardware and cannot be removed dynamically, a system reboot will be required for the configuration to take effect.