Look up another CVE · open CVE-2026-72049 in the interactive tracker
CVE-2026-72049
ieee802154: admin-gate legacy LLSEC dump operations
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/ieee802154. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-72049 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixed | 6.1.180-1 | Update the kernel and reboot. Fixed in 6.1.180-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixed | 6.12.100-1 | Update the kernel and reboot. Fixed in 6.12.100-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which sets no .flags, so generic netlink runs them ungated. The modern nl802154 family admin-gates the equivalent reads via NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev that has an LLSEC key installed; the dump handler writes the raw 16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied verbatim from struct ieee802154_llsec_key.key) into the reply. Recovering the AES key compromises 802.15.4 LLSEC link confidentiality and authenticity, since LLSEC uses CCM* and the same key authenticates and encrypts frames. Impact: any local uid with no capabilities can read the raw 16-byte AES-128 LLSEC key from the kernel keytable on any wpan netdev that has an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY dump on the legacy IEEE802154_NL generic-netlink family. Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the modern nl802154 family exposes their equivalents to unprivileged readers by design (NL802154_CMD_GET_WPAN_PHY and NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged users" annotations).
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/ieee802154/ieee802154.h
net/ieee802154/netlink.c
- What this is
- IEEE 802.15.4 SUBSYSTEMMAINTAINERS section matched on net/ieee802154/ · linux-wpan@vger.kernel.org · Maintained
- Kernel module
- ieee802154
Check it on the machine
grep -w CONFIG_IEEE802154 /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ieee802154Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_IEEE802154
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.1 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Nsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 4.8% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/ieee802154
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.16 | 5.10.261 | 3465035ba18b |
| 3.16 | 5.15.212 | dffe745760f3 |
| 3.16 | 6.1.178 | e84708ef7521 |
| 3.16 | 6.6.145 | 5abe94a20553 |
| 3.16 | 6.12.97 | 09fd25cd8cd8 |
| 3.16 | 6.18.40 | 1905ebabe638 |
| 3.16 | 7.1.5 | 638324805895 |
| 3.16 | 7.2 | 9c1e0b6d4947 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires a local syscall path: open AF_NETLINK/NETLINK_GENERIC, resolve the "802.15.4 MAC" genl family, and send an NLM_F_DUMP for IEEE802154_LLSEC_LIST_KEY; the bug is in kernel netlink configuration code, not in remote 802.15.4 frame handling.
- AC:LAttack complexity, low
- Once IEEE802154/LLSEC is enabled and keys are installed on a wpan netdev (typical on Zigbee/6LoWPAN gateways and industrial IoT coordinators), an attacker can deterministically trigger the dump and receive key material without races or special memory layout.
- PR:LPrivileges required, low
- The vulnerable dump ops lack GENL_ADMIN_PERM, so netlink_capable(CAP_NET_ADMIN) is never enforced; any basic local UID with permission to create generic-netlink sockets (no capabilities) can read administrator-installed LLSEC keys.
- UI:NUser interaction, none
- No victim interaction is required beyond the attacker already having local execution access; exploitation is a direct netlink dump request with no user clicks, mounts, or device pairing steps.
- S:UScope, unchanged
- Impact stays within the host kernel/network stack security boundary (disclosure of kernel-held LLSEC credentials); it does not cross VM, container, or IOMMU isolation boundaries.
- C:HConfidentiality impact, high
- The dump handler returns full raw 16-byte AES-128 LLSEC key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES) for every installed key, enabling decryption of all CCM*-protected 802.15.4 traffic protected by those keys.
- I:HIntegrity impact, high
- Disclosed AES-128 LLSEC keys are used for both encryption and authentication (CCM*); possession enables forging cryptographically valid LLSEC frames and impersonating trusted WPAN devices on Zigbee/6LoWPAN/industrial sensor networks.
- A:NAvailability impact, none
- The bug is a read-only information disclosure via netlink attribute copying; it does not corrupt memory, panic the kernel, or cause hangs or denial of service.