In the Linux kernel, macsec_encrypt() incorrectly reads the Ethernet header when the MAC header is unset. During transmission via an AF_PACKET SOCK_RAW socket with the PACKET_QDISC_BYPASS flag, the skb's mac_header field is not initialized, causing eth_hdr(skb) to reference memory beyond the allocated buffer. This 12‑byte out‑of‑bounds read can expose kernel memory contents and corrupt the Ethernet frame sent on the wire, potentially revealing sensitive data.

Any system running a Linux kernel that processes traffic through the AF_PACKET SOCK_RAW path with the PACKET_QDISC_BYPASS option is affected. All Linux kernel versions prior to the patch containing the fix are vulnerable.

The CVSS score is not provided, and the EPSS is unavailable, so the exploitation likelihood cannot be quantified precisely. The vulnerability is not listed in the CISA KEV catalog, indicating no known public exploits at this time. The attack vector would require a process with the ability to create AF_PACKET SOCK_RAW sockets and enable PACKET_QDISC_BYPASS, typically a privileged user, to trigger the out‑of‑bounds read. An attacker could use the leaked data to perform information disclosure or gather information that might aid other attacks.