Executive brief
The Linux kernel's MACsec (MAC Security) driver contains a heap over-read vulnerability in packet encryption. When certain raw packet transmit paths send data without setting a MAC header field, the driver reads from an invalid memory location, leaking up to 12 bytes of heap data that can be transmitted on the network or cause system crashes on certain kernel configurations.
Technical details
The vulnerability is a heap over-read (CWE-125) in the macsec_encrypt() function in drivers/net/macsec.c. The function reads the Ethernet header using eth_hdr(skb), which computes the address as skb->head + skb->mac_header. On AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit paths, the MAC header is unset, causing skb->mac_header to be (u16)~0 (65535), resulting in reading 12 bytes from memory far beyond the allocated buffer. This 12-byte heap over-read is emitted on the wire as the frame's source/destination MAC addresses, and KASAN detects it as a slab-out-of-bounds read. The fix replaces eth_hdr(skb) with skb_eth_hdr(skb), which correctly reads from skb->data on the TX path. No authentication or special privileges are required—a local user can trigger this via AF_PACKET raw sockets.
Affected products
- Linux Linux kernel 6.0 and earlier versions with macsec driver
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-03: patched: Upstream fix commit f5089008f90c0a7c5520dff3934e0af00adf322d by Daehyeon Ko