{"apiVersion":"1.0","identifier":"CVE-2026-72072","description":"In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete When an offloaded MACsec RX SC is deleted, macsec_del_rxsc_ctx() freed the per-SC metadata_dst with metadata_dst_free(), which kfree()s the object unconditionally and ignores the dst reference count. The RX datapath in mlx5e_macsec_offload_handle_rx_skb() looks up the SC under rcu_read_lock() via xa_load(), takes a reference with dst_hold() and attaches the dst to the skb with skb_dst_set(). A reader that already obtained the rx_sc pointer can race with the delete path and operate on freed memory. Fix the owner side by dropping the reference with dst_release() instead of freeing unconditionally, and convert the RX datapath to dst_hold_safe() so a reader racing the SC delete cannot attach a dst whose last reference was just dropped; only attach it when a reference was actually taken. mlx5e_macsec_add_rxsc() also published sc_xarray_element via xa_alloc() before rx_sc->md_dst was allocated and initialised, so a datapath reader that looked the SC up by fs_id could observe rx_sc with md_dst still NULL or, on weakly-ordered architectures, a non-NULL md_dst pointer whose contents were not yet visible. NULL-check the xa_load() result and md_dst on the datapath, and reorder add_rxsc() so the xa_alloc() publish happens only after md_dst is fully initialised; the xarray RCU publish then pairs with the rcu_read_lock()/xa_load() in the datapath. Note: macsec_del_rxsc_ctx() also kfree()s rx_sc->sc_xarray_element without an RCU grace period while the same datapath reads it under rcu_read_lock(); that is a separate pre-existing issue left to a follow-up patch. Found by 0sec automated security-research tooling (https://0sec.ai).","publishedAt":"2026-08-15T06:21:16","lastModifiedAt":"2026-08-17T06:18:05","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72072","cvssScore":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00171,"riskScore":0.79,"affectedProduct":"linux","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72072","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72072","en":"https://www.redsauce.net/en/cves/CVE-2026-72072","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72072","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72072","de":"https://www.redsauce.net/de/cves/CVE-2026-72072","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72072","el":"https://www.redsauce.net/el/cves/CVE-2026-72072"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72072"}}