In the Linux kernel, macsec_encrypt() incorrectly reads the Ethernet header when the MAC header is unset. When a packet is transmitted through an AF_PACKET SOCK_RAW socket with the PACKET_QDISC_BYPASS flag, the skb's mac_header field remains unset, causing eth_hdr(skb) to reference memory beyond the allocated buffer. The resulting 12‑byte out‑of‑bounds read exposes kernel memory contents and the leaked data appears in the outer source/destination MAC on the wire, potentially revealing sensitive information.

Any system running a Linux kernel that processes traffic through the AF_PACKET SOCK_RAW path with the PACKET_QDISC_BYPASS option is affected. All kernel versions before the patch that injects skb_eth_hdr() into macsec_encrypt() are vulnerable.

The CVSS score of 7.3 indicates a moderate‑to‑high severity, while the EPSS < 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at this time. The attack vector would require a process with the ability to create AF_PACKET SOCK_RAW sockets and enable PACKET_QDISC_BYPASS, typically a privileged user, to trigger the out‑of‑bounds read. An attacker could use the leaked data to perform information disclosure or gather information that might aid other attacks.