The Linux kernel vulnerability CVE-2026-72019 involves macsec_encrypt() reading the Ethernet header via eth_hdr(skb) which uses skb->head + skb->mac_header. On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path, the MAC header is unset, causing eth_hdr(skb) to resolve to an out-of-bounds memory location, resulting in a 12-byte heap over-read. This over-read is also emitted on the wire as the frame's outer source/destination MAC addresses. The issue was detected by KASAN and CONFIG_DEBUG_NET builds. The fix involves using skb_eth_hdr(), which accesses the L2 header at skb->data, avoiding assumptions about the MAC header being set.

This vulnerability causes a heap out-of-bounds read of 12 bytes in kernel memory during packet transmission, which can leak unintended memory contents as part of the Ethernet frame's outer MAC addresses. While this is a memory safety issue, no direct code execution or privilege escalation impact is described. The data leak could potentially expose sensitive kernel memory contents on the network.

A fix for this vulnerability has been implemented in the Linux kernel by modifying macsec_encrypt() to use skb_eth_hdr() instead of eth_hdr(skb), preventing out-of-bounds reads when the MAC header is unset. Users should update to a Linux kernel version that includes this fix. Patch status is not explicitly stated in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed version and apply the update accordingly.