Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-72049— ieee802154: admin-gate legacy LLSEC dump operations

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于legacy IEEE802154_NL家族的LLSEC dump操作缺少管理员权限控制，可能导致本地用户读取AES-128 LLSEC密钥，破坏802.15.4 LLSEC链路的机密性和真实性。

CVSS 7.1 · High EPSS 0.16% · P5

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 3e9c156e2c210ab67b12b1b692983a6b97c19d3f< 3465035ba18b1ed50f8d201897d14135d20532b0 affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< dffe745760f38fac0b8288e0dc4759b23d9888ff affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< e84708ef7521f3bffc85a449954042018abbd60e affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< 5abe94a205539d27945cda3ba43fdcfe295cf2c8 affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< 09fd25cd8cd80a6b3edef04e53a7324d06ac2180 affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< 1905ebabe638c946aced00c4bb664da26cac56d5 affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< 6383248058956f2a52d720b1e9f8921099cdae04 affected
3e9c156e2c210ab67b12b1b692983a6b97c19d3f< 9c1e0b6d49471a712511d23fc9d06901561135e8 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72049

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ieee802154: admin-gate legacy LLSEC dump operations
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which sets no .flags, so generic netlink runs them ungated. The modern nl802154 family admin-gates the equivalent reads via NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev that has an LLSEC key installed; the dump handler writes the raw 16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied verbatim from struct ieee802154_llsec_key.key) into the reply. Recovering the AES key compromises 802.15.4 LLSEC link confidentiality and authenticity, since LLSEC uses CCM* and the same key authenticates and encrypts frames. Impact: any local uid with no capabilities can read the raw 16-byte AES-128 LLSEC key from the kernel keytable on any wpan netdev that has an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY dump on the legacy IEEE802154_NL generic-netlink family. Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the modern nl802154 family exposes their equivalents to unprivileged readers by design (NL802154_CMD_GET_WPAN_PHY and NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged users" annotations).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于legacy IEEE802154_NL家族的LLSEC dump操作缺少管理员权限控制，可能导致本地用户读取AES-128 LLSEC密钥，破坏802.15.4 LLSEC链路的机密性和真实性。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3e9c156e2c210ab67b12b1b692983a6b97c19d3f ~ 3465035ba18b1ed50f8d201897d14135d20532b0 -
Linux Linux 3.16 -

II. Public POCs for CVE-2026-72049

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72049

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72049 (8)

Same Patch Batch · Linux · 2026-08-15 · 844 CVEs total

CVE-2026-74475 10.0 CRITICAL vxlan: use neigh_ha_snapshot() in route_shortcircuit()
CVE-2026-74279 10.0 CRITICAL crypto: cavium/cpt - fix DMA cleanup using wrong loop index
CVE-2026-74280 10.0 CRITICAL crypto: marvell/octeontx - fix DMA cleanup using wrong loop index
CVE-2026-74309 10.0 CRITICAL vdpa/octeon_ep: fix IRQ-to-ring mapping in interrupt handler
CVE-2026-72421 10.0 CRITICAL ipv4: fib: Don't ignore error route in local/main tables.
CVE-2026-72407 10.0 CRITICAL geneve: validate inner network offset in geneve_gro_complete()
CVE-2026-72408 10.0 CRITICAL geneve: gate GRO hint in geneve_gro_complete() on gs->gro_hint
CVE-2026-72493 9.9 CRITICAL net: serialize netif_running() check in enqueue_to_backlog()
CVE-2026-72322 9.8 CRITICAL ipv6: mcast: Fix potential UAF in MLD delayed work
CVE-2026-72206 9.8 CRITICAL ntfs: validate index block header more strictly
CVE-2026-72429 9.8 CRITICAL ipv6: ioam: fix type confusion of dst_entry
CVE-2026-72129 9.8 CRITICAL nvmet-rdma: handle inline data with a nonzero offset
CVE-2026-72130 9.8 CRITICAL nvmet-auth: reject short AUTH_RECEIVE buffers
CVE-2026-72436 9.8 CRITICAL netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types
CVE-2026-72207 9.8 CRITICAL ntfs: not change 0-byte $DATA attribute to non-resident
CVE-2026-72319 9.8 CRITICAL ipvs: ensure inner headers in ICMP errors are in headroom
CVE-2026-72317 9.8 CRITICAL SUNRPC: pin upper rpc_clnt across the TLS connect_worker
CVE-2026-74427 9.8 CRITICAL afs: Fix netns teardown to cancel the preallocation charger
CVE-2026-72137 9.8 CRITICAL xfrm: nat_keepalive: avoid double free on send error
CVE-2026-74376 9.8 CRITICAL md/raid10: reset read_slot when reusing r10bio for discard

Showing top 20 of 844 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-72049

No comments yet

Leave a comment