CVE-2026-72072 Linux CVE debrief

Who should care

Linux kernel users and administrators, as well as security teams and vulnerability management teams, should be aware of this vulnerability and take steps to mitigate it. This includes verifying system configurations for potential vulnerabilities, monitoring system logs for suspicious activity, and applying patches for CVE-2026-72072. Additionally, operators and platform administrators should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. Those with affected product deployments should assign an owner for follow-up and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Compensating controls for exposed systems should be reviewed while remediation is scheduled and verified. Relevant monitoring, detection, and logs for exposed assets should be checked for extra review, and exceptions, retested remediated assets, and closed items should be tracked only after evidence is documented. Asset inventory and source tracking are also crucial in addressing this vulnerability. Those impacted should also consider rollback/change windows as part of their mitigation strategy. This vulnerability can have significant operational impact if not properly addressed, and understanding the source-confidence limits and review context is essential for effective mitigation. Therefore, it is crucial for all relevant parties to be proactive in their approach to addressing CVE-2026-72072. This includes not only technical teams but also management and leadership, as the potential impact of this vulnerability can be substantial if left unaddressed. By taking a comprehensive approach to mitigation, organizations can minimize the risks associated with this vulnerability and ensure the security and integrity of their systems. In terms of defensive priority, Linux kernel users should verify their systems are updated with the latest security patches to mitigate potential use-after-free vulnerabilities. This should be a top priority for security teams and vulnerability management teams. Overall, a coordinated effort is required to effectively address CVE-2026-72072 and minimize its who

Technical summary

The CVE-2026-72072 vulnerability involves a use-after-free issue in the Linux kernel's net/mlx5e: macsec module. When an offloaded MACsec RX SC is deleted, the per-SC metadata_dst is freed, but the RX datapath may still operate on the freed memory. The issue is resolved by dropping the reference with dst_release() instead of freeing unconditionally and converting the RX datapath to dst_hold_safe().

Defensive priority

Linux kernel users should verify their systems are updated with the latest security patches to mitigate potential use-after-free vulnerabilities.

Recommended defensive actions

• Verify Linux kernel version and apply patches for CVE-2026-72072
• Review system configurations for potential vulnerabilities
• Monitor system logs for suspicious activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE-2026-72072 vulnerability involves a use-after-free issue in the Linux kernel's net/mlx5e: macsec module. When an offloaded MACsec RX SC is deleted, the per-SC metadata_dst is freed, but the RX datapath may still operate on the freed memory. The issue is resolved by dropping the reference with dst_release() instead of freeing unconditionally and converting the RX datapath to dst_hold_safe().

Official resources