---
id: CVE-2026-72019
title: 'macsec: don''t read an unset MAC header in macsec_encrypt()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  macsec: don't read an unset MAC header in macsec_encrypt()

  macsec_encrypt() reads the Ethernet header via eth_hdr(skb)
  (skb->head + skb->mac_header) to memmove() the 1…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    b6cec6187b8632423cd99a94fd5e5ba165fa2a33
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    3adea1b1c04b57e08a5c12a1f42483760581ce61
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    dc9ffa1905e72f026d080880a2e4cfc42aa91000
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    f21fa533a3ed15ada74106aac4b9ddd078fc6b7a
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    e17a42199824973cd8212e95b21ffadf4114a21b
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    2cf10d042562283ff4ae97c02d0993d4f1b5ea29
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    c39087ad0b97fc11a3b058dfc8db9fd370762cb9
  - >-
    Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 <
    f5089008f90c0a7c5520dff3934e0af00adf322d
  - Linux 4.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-16T15:50:03.923013Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:53:16.257Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72019'
references:
  - url: 'https://git.kernel.org/stable/c/b6cec6187b8632423cd99a94fd5e5ba165fa2a33'
  - url: 'https://git.kernel.org/stable/c/3adea1b1c04b57e08a5c12a1f42483760581ce61'
  - url: 'https://git.kernel.org/stable/c/dc9ffa1905e72f026d080880a2e4cfc42aa91000'
  - url: 'https://git.kernel.org/stable/c/f21fa533a3ed15ada74106aac4b9ddd078fc6b7a'
  - url: 'https://git.kernel.org/stable/c/e17a42199824973cd8212e95b21ffadf4114a21b'
  - url: 'https://git.kernel.org/stable/c/2cf10d042562283ff4ae97c02d0993d4f1b5ea29'
  - url: 'https://git.kernel.org/stable/c/c39087ad0b97fc11a3b058dfc8db9fd370762cb9'
  - url: 'https://git.kernel.org/stable/c/f5089008f90c0a7c5520dff3934e0af00adf322d'
tags:
  - cve.org
epss: 0.00172
epssPercentile: 0.06161
ingestedAt: '2026-10-16T17:24:46.870Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

macsec: don't read an unset MAC header in macsec_encrypt()

macsec_encrypt() reads the Ethernet header via eth_hdr(skb)
(skb->head + skb->mac_header) to memmove() the 12 source/destination MAC
bytes forward and make room for the SecTAG.

On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb
reaches the macsec ndo_start_xmit() with the MAC header unset, so
eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of
bounds: a 12-byte heap over-read that is also emitted on the wire as the
frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds
read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET
build flags it as an unset mac header in skb_mac_header().

On the TX path the L2 header is at skb->data, so use skb_eth_hdr(), added
by commit 96cc4b69581d ("macvlan: do not assume mac_header is set in
macvlan_broadcast()") for exactly this purpose.

## Affected

- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < b6cec6187b8632423cd99a94fd5e5ba165fa2a33`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < 3adea1b1c04b57e08a5c12a1f42483760581ce61`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < dc9ffa1905e72f026d080880a2e4cfc42aa91000`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < f21fa533a3ed15ada74106aac4b9ddd078fc6b7a`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < e17a42199824973cd8212e95b21ffadf4114a21b`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < 2cf10d042562283ff4ae97c02d0993d4f1b5ea29`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < c39087ad0b97fc11a3b058dfc8db9fd370762cb9`
- `Linux >= c09440f7dcb304002dfced8c0fea289eb25f2da0 < f5089008f90c0a7c5520dff3934e0af00adf322d`
- `Linux 4.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.