CVE-2026-72049

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: admin-gate legacy LLSEC dump operations

In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table

builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV,

LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which

sets no .flags, so generic netlink runs them ungated. The modern

nl802154 family admin-gates the equivalent reads via

NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM.

Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve

the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev

that has an LLSEC key installed; the dump handler writes the raw

16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied

verbatim from struct ieee802154_llsec_key.key) into the reply.

Recovering the AES key compromises 802.15.4 LLSEC link confidentiality

and authenticity, since LLSEC uses CCM* and the same key authenticates

and encrypts

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References