CVE-2026-72441

A flaw was found in the Linux kernel's IEEE 802.15.4 (Wireless Personal Area Networks) networking component. This vulnerability allows a local user to expose sensitive kernel memory. The issue arises because a specific field (pan_id) in a network address structure is not properly cleared, leading to uninitialized data being copied to user space. This could result in the disclosure of potentially sensitive information from the kernel's memory.

A flaw was found in the Linux kernel's IEEE 802.15.4 (wireless personal area network) implementation, where a local user can disclose a small amount of uninitialized kernel stack memory. When a received IEEE 802.15.4 frame uses the IEEE802154_ADDR_NONE address mode, the pan_id field of the in-kernel address structure is left uninitialized. When such a datagram is received on an AF_IEEE802154 datagram socket, that uninitialized data is copied into the sockaddr_ieee802154 structure returned to user space by recvmsg(), leaking uninitialized kernel stack bytes to the receiving process. The consequence is limited to information disclosure of potentially sensitive kernel memory.

Red Hat rates this flaw as Moderate security impact. Red Hat Enterprise Linux 6 and 7 (kernel and kernel-rt) are not affected because the vulnerable code is not present. The kernel components in Red Hat Enterprise Linux 8, 9, and 10 update streams (together with kernel-rt where provided), and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2, are affected; for these streams the fix has been deferred. Because exploiting this flaw requires local access to receive IEEE 802.15.4 datagrams and the exposure is limited to a small amount of uninitialized kernel stack memory, the practical risk is considered low, and the fix will be delivered in a future planned update rather than an immediate z-stream update. The residual risk of the deferral is that a local unprivileged user could disclose a small amount of potentially sensitive kernel stack memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.