CVE-2026-72072 - Vulnerability Details

- net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed
the per-SC metadata_dst with metadata_dst_free(), which kfree()s the
object unconditionally and ignores the dst reference count. The RX
datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under
rcu_read_lock() via xa_load(), takes a reference with dst_hold() and
attaches the dst to the skb with skb_dst_set(). A reader that already
obtained the rx_sc pointer can race with the delete path and operate on
freed memory.

Fix the owner side by dropping the reference with dst_release() instead
of freeing unconditionally, and convert the RX datapath to
dst_hold_safe() so a reader racing the SC delete cannot attach a dst
whose last reference was just dropped; only attach it when a reference
was actually taken.

mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc()
before rx_sc->md_dst was allocated and initialised, so a datapath reader
that looked the SC up by fs_id could observe rx_sc with md_dst still
NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer
whose contents were not yet visible. NULL-check the xa_load() result and
md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish
happens only after md_dst is fully initialised; the xarray RCU publish
then pairs with the rcu_read_lock()/xa_load() in the datapath.

Note: macsec_del_rxsc_ctx() also kfree()s rx_sc->sc_xarray_element
without an RCU grace period while the same datapath reads it under
rcu_read_lock(); that is a separate pre-existing issue left to a
follow-up patch.

Found by 0sec automated security-research tooling (https://0sec.ai).

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Based on the description, it is inferred that the flaw arises when a MACsec receive security context is deleted while the driver still holds a reference to its metadata. The unguarded free allows an attacker to cause the kernel to dereference dangling memory, which can corrupt critical kernel structures or crash the system. If an attacker can trigger this race condition, they could gain kernel‑level execution and full control of the host.

Affected Systems

All Linux installations that load the mlx5e driver and enable MACsec offloading are affected. The vulnerability is present in any kernel version that includes the unpatched mlx5e code path for MACsec receive sessions, regardless of the chipset vendor, and remains until the CVE‑2026‑72072 patch is applied.

Risk and Exploitability

The CVSS score of 7.8 places it at high severity, but the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that exploitation would require an attacker who can influence MACsec traffic to an interface using the mlx5e driver, such as by sending crafted MACsec frames. The likely attack vector therefore requires kernel‑level access to the NIC’s MACsec state, making it a higher‑complexity, targeted threat rather than a broad‑scale attack vector.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b7c9400cbc48c3713190b3bce4e0c87e924e4104`	affected	< b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb
`b7c9400cbc48c3713190b3bce4e0c87e924e4104`	affected	< 218cc15a4c907659ad4b0e68c535c61594311205
`b7c9400cbc48c3713190b3bce4e0c87e924e4104`	affected	< 4a5073b7b30243658f58b2d2d35a823da7fd34d9
`b7c9400cbc48c3713190b3bce4e0c87e924e4104`	affected	< ed3cc4218070d6b98bf5fb456dccae424fd38c4f
`b7c9400cbc48c3713190b3bce4e0c87e924e4104`	affected	< 088873af13590ebde10de2ade847f57a05ec61c6
`b7c9400cbc48c3713190b3bce4e0c87e924e4104`	affected	< de74d8fd10291763d97b218f09adcc7513c975e4

Linux

affected

Version	Status	Constraints
`6.1`	affected	—
`0`	unaffected	< 6.1
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b7c9400cbc48c3713190b3bce4e0c87e924e4104,b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb)`	affected	code_commit	—
`[b7c9400cbc48c3713190b3bce4e0c87e924e4104,218cc15a4c907659ad4b0e68c535c61594311205)`	affected	code_commit	—
`[b7c9400cbc48c3713190b3bce4e0c87e924e4104,4a5073b7b30243658f58b2d2d35a823da7fd34d9)`	affected	code_commit	—
`[b7c9400cbc48c3713190b3bce4e0c87e924e4104,ed3cc4218070d6b98bf5fb456dccae424fd38c4f)`	affected	code_commit	—
`[b7c9400cbc48c3713190b3bce4e0c87e924e4104,088873af13590ebde10de2ade847f57a05ec61c6)`	affected	code_commit	—
`[b7c9400cbc48c3713190b3bce4e0c87e924e4104,de74d8fd10291763d97b218f09adcc7513c975e4)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.1`	affected	generic	—
`[0,6.1)`	unaffected	generic	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply a kernel update that incorporates the CVE‑2026‑72072 fix.
If a kernel upgrade is not immediately possible, disable MACsec offloading on the affected interfaces with ethtool –K <iface> macsec off or by loading the driver with a module option that turns off MACsec support.
Continuously monitor kernel logs for Oops, panic, crash messages related to mlx5e or MACsec, and promptly apply any subsequent security updates.

Generated by OpenCVE AI on August 18, 2026 at 05:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00171.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/088873af13590ebde10de2ade847f57a05ec61c6
https://git.kernel.org/stable/c/218cc15a4c907659ad4b0e68c535c61594311205
https://git.kernel.org/stable/c/4a5073b7b30243658f58b2d2d35a823da7fd34d9
https://git.kernel.org/stable/c/b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb
https://git.kernel.org/stable/c/de74d8fd10291763d97b218f09adcc7513c975e4
https://git.kernel.org/stable/c/ed3cc4218070d6b98bf5fb456dccae424fd38c4f
https://lore.kernel.org/linux-cve-announce/2026081519-CVE-2026-72072-111b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72072
https://www.cve.org/CVERecord?id=CVE-2026-72072

History

Tue, 18 Aug 2026 04:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081519-CVE-2026-72072-111b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72072 https://www.cve.org/CVERecord?id=CVE-2026-72072
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 21:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 21:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory. Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken. mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc->md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath. Note: macsec_del_rxsc_ctx() also kfree()s rx_sc->sc_xarray_element without an RCU grace period while the same datapath reads it under rcu_read_lock(); that is a separate pre-existing issue left to a follow-up patch. Found by 0sec automated security-research tooling (https://0sec.ai).
Title		net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/088873af13590ebde10de2ade847f57a05ec61c6 https://git.kernel.org/stable/c/218cc15a4c907659ad4b0e68c535c61594311205 https://git.kernel.org/stable/c/4a5073b7b30243658f58b2d2d35a823da7fd34d9 https://git.kernel.org/stable/c/b1a4d0c568bbb52c7c04f4fce3c097dae89ed6cb https://git.kernel.org/stable/c/de74d8fd10291763d97b218f09adcc7513c975e4 https://git.kernel.org/stable/c/ed3cc4218070d6b98bf5fb456dccae424fd38c4f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:52:23.946Z

Updated: 2026-08-17T05:40:03.099Z

Reserved: 2026-08-09T03:40:39.904Z

Link: CVE-2026-72072

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:16.943

Modified: 2026-08-17T06:18:05.787

Link: CVE-2026-72072

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72072 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T05:45:03Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object