CVE-2026-72072

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed

the per-SC metadata_dst with metadata_dst_free(), which kfree()s the

object unconditionally and ignores the dst reference count. The RX

datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under

rcu_read_lock() via xa_load(), takes a reference with dst_hold() and

attaches the dst to the skb with skb_dst_set(). A reader that already

obtained the rx_sc pointer can race with the delete path and operate on

freed memory.

Fix the owner side by dropping the reference with dst_release() instead

of freeing unconditionally, and convert the RX datapath to

dst_hold_safe() so a reader racing the SC delete cannot attach a dst

whose last reference was just dropped; only attach it when a reference

was actually taken.

mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References