CVE-2026-72072

A flaw was found in the Linux kernel's MACsec (Media Access Control Security) component. A race condition during the deletion of an offloaded MACsec RX Security Channel (SC) allows the RX datapath to access and operate on memory that has already been freed. This use-after-free vulnerability can lead to system instability or a denial of service.

A use-after-free can occur in the mlx5e MACsec RX offload path when RX SC deletion races with packet processing. The delete path used metadata_dst_free and could free the per SC metadata_dst without respecting dst references, while mlx5e_macsec_offload_handle_rx_skb() could already have loaded the SC through xa_load() under rcu_read_lock() and then attach the dst to an skb. This can lead to a kernel crash and in the worst case may create a memory corruption condition in the networking datapath. For the CVSS the PR:L is used for the paranoid score because delegated CAP_NET_ADMIN, container root, or a network management service account may be enough to delete or reconfigure MACsec RX SC state in some deployments. The issue is not Internet routed AV:N and is better treated as adjacent network plus local control plane exposure because MACsec operates at L2 and requires mlx5e MACsec offload to be configured. Impact is at least denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to UAF based memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.