Answer in brief
CVE-2026-72049 records a High severity (CVSS 7.1) vulnerability in ieee802154: admin-gate legacy LLSEC dump operations. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <3465035ba18b1ed50f8d201897d14135d20532b0 || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <dffe745760f38fac0b8288e0dc4759b23d9888ff || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <e84708ef7521f3bffc85a449954042018abbd60e || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <5abe94a205539d27945cda3ba43fdcfe295cf2c8 || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <09fd25cd8cd80a6b3edef04e53a7324d06ac2180 || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <1905ebabe638c946aced00c4bb664da26cac56d5 || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <6383248058956f2a52d720b1e9f8921099cdae04 || >=3e9c156e2c210ab67b12b1b692983a6b97c19d3f <9c1e0b6d49471a712511d23fc9d06901561135e8 | 3465035ba18b1ed50f8d201897d14135d20532b0, dffe745760f38fac0b8288e0dc4759b23d9888ff, e84708ef7521f3bffc85a449954042018abbd60e, 5abe94a205539d27945cda3ba43fdcfe295cf2c8, 09fd25cd8cd80a6b3edef04e53a7324d06ac2180, 1905ebabe638c946aced00c4bb664da26cac56d5, 6383248058956f2a52d720b1e9f8921099cdae04, 9c1e0b6d49471a712511d23fc9d06901561135e8 |
| Linux/Linuxgeneric | 3.16 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 17, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ieee802154: admin-gate legacy LLSEC dump operations In net/ieee802154/netlink.c, the legacy IEEE802154_NL family ops table builds the LLSEC dump entries (LLSEC_LIST_KEY, LLSEC_LIST_DEV, LLSEC_LIST_DEVKEY, LLSEC_LIST_SECLEVEL) with IEEE802154_DUMP() which sets no .flags, so generic netlink runs them ungated. The modern nl802154 family admin-gates the equivalent reads via NL802154_CMD_GET_SEC_KEY and friends with .flags = GENL_ADMIN_PERM. Any local uid that can open AF_NETLINK / NETLINK_GENERIC can resolve the "802.15.4 MAC" family and dump LLSEC_LIST_KEY on any wpan netdev that has an LLSEC key installed; the dump handler writes the raw 16-byte AES-128 key bytes (IEEE802154_ATTR_LLSEC_KEY_BYTES, copied verbatim from struct ieee802154_llsec_key.key) into the reply. Recovering the AES key compromises 802.15.4 LLSEC link confidentiality and authenticity, since LLSEC uses CCM* and the same key authenticates and encrypts frames. Impact: any local uid with no capabilities can read the raw 16-byte AES-128 LLSEC key from the kernel keytable on any wpan netdev that has an administrator-installed LLSEC key, by issuing an LLSEC_LIST_KEY dump on the legacy IEEE802154_NL generic-netlink family. Introduce IEEE802154_DUMP_PRIV() mirroring IEEE802154_DUMP() but setting .flags = GENL_ADMIN_PERM, and use it for the four LLSEC dump entries. LIST_PHY and LIST_IFACE retain IEEE802154_DUMP() because the modern nl802154 family exposes their equivalents to unprivileged readers by design (NL802154_CMD_GET_WPAN_PHY and NL802154_CMD_GET_INTERFACE carry "can be retrieved by unprivileged users" annotations).
Quoted source text, attributed separately from HOL analysis.