Executive brief
The Linux kernel's IEEE 802.15.4 wireless networking subsystem exposes encryption keys through an insufficiently restricted network interface. Any local user without special privileges can retrieve the raw 16-byte AES-128 keys used to secure 802.15.4 wireless communications, allowing them to decrypt and forge network messages. This compromises the confidentiality and authenticity of 802.15.4 wireless links on affected systems.
Technical details
The vulnerability exists in net/ieee802154/netlink.c, where legacy LLSEC (Link Layer Security) dump operations (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) are exposed via the IEEE802154_NL generic netlink family without permission checks, unlike the modern nl802154 family which correctly gates these operations with GENL_ADMIN_PERM. Any local user with the ability to open AF_NETLINK/NETLINK_GENERIC sockets can invoke LLSEC_LIST_KEY to dump the raw key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES) from struct ieee802154_llsec_key, bypassing authentication requirements. Since IEEE 802.15.4 LLSEC uses CCM* mode where the same key both authenticates and encrypts frames, disclosure of the key completely breaks both confidentiality and integrity. The fix involves introducing IEEE802154_DUMP_PRIV() to gate LLSEC dump operations with GENL_ADMIN_PERM.
Affected products
- Linux Linux kernel Multiple versions (fix introduced CVE-2026-72049)
Timeline
- 2026-08-15: disclosed