CVE-2026-72049 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of systems using ieee802154, security teams monitoring for local attacks, and operators of affected platforms should be aware of this vulnerability. They should assess their exposure, review vendor guidance, and apply necessary patches or mitigations. Security teams should monitor for suspicious activity related to LLSEC keys and restrict access to wpan netdev with LLSEC keys installed. Vulnerability management and security teams need to prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Asset inventory and configuration management teams should also review their systems for potential exposure. Additionally, incident response teams should be prepared to handle potential exploitation attempts. This requires coordination between development, operations, and security teams to ensure comprehensive mitigation and response efforts. The scope of impact includes potential unauthorized access to sensitive information and disruption of critical infrastructure. Therefore, it is crucial for affected organizations to take immediate action to mitigate this vulnerability and prevent potential attacks. The involvement of multiple teams is necessary to address the technical, operational, and security aspects of this vulnerability effectively. By working together, organizations can minimize the risk associated with this vulnerability and protect their assets from potential exploitation. Effective communication and collaboration among teams are essential to ensure a swift and comprehensive response to this security threat. This vulnerability highlights the importance of maintaining up-to-date systems, implementing robust security measures, and fostering a culture of security awareness within organizations. By prioritizing security and taking proactive measures, organizations can reduce the likelihood of successful exploitation and minimize potential damage. In conclusion, a coordinated effort from various stakeholders is required to address the implications of this vulnerability and ensure the security and integrity of affected systems. The recommended actions and mitigation steps,

Technical summary

The Linux kernel's ieee802154 implementation did not properly gate legacy LLSEC dump operations, allowing local users to read raw 16-byte AES-128 LLSEC keys from the kernel keytable on any wpan netdev with an administrator-installed LLSEC key. This vulnerability compromises 802.15.4 LLSEC link confidentiality and authenticity. The modern nl802154 family admin-gates equivalent reads via NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM, but the legacy IEEE802154_NL family ops table builds LLSEC dump entries with IEEE802154_DUMP() which sets no .flags.

Defensive priority

Local attackers with no capabilities can exploit this vulnerability to compromise 802.15.4 LLSEC link confidentiality and authenticity.

Recommended defensive actions

• Inventory and assess linux kernel versions in use
• Apply kernel updates or patches for ieee802154
• Monitor for suspicious activity related to LLSEC keys
• Restrict access to wpan netdev with LLSEC keys installed
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in the Linux kernel related to ieee802154 and LLSEC dump operations. Limited information is available on the exploitability and impact.

Official resources