CVE-2026-72072Medium· 4.1▾ SunlitA flaw was found in the Linux kernel's MACsec (Media Access Control Security) component. A race condition during the deletion of an offloaded MACsec RX Security Channel (SC) allows the RX datapath to access and operate on memory that has a…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 22.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the vendor's CSAF advisory record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
0.2% → 0.2%
7.8 → 4.1
high → medium
A flaw was found in the Linux kernel's MACsec (Media Access Control Security) component. A race condition during the deletion of an offloaded MACsec RX Security Channel (SC) allows the RX datapath to access and operate on memory that has already been freed. This use-after-free vulnerability can lead to system instability or a denial of service.
kernel: net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete — rated Moderate by Red Hat. Released 2026-08-15, updated 2026-10-26.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:70459
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-53747High· 7.8In the Linux kernel, the following vulnerability has been resolved: vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF After a call to console_unlock() in vcs_write() the vc_data struct can be freed by vc_port…
CVE-2023-54292Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix data race on CQP request done KCSAN detects a data race on cqp_request->request_done memory location which is accessed locklessly in irdma_handle_cqp_o…
CVE-2026-64319Critical· 9.1In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: validate reply message payload bounds against transfer length nvmet_auth_reply() accesses the variable-length rval[] array using attacker-controlled hl (ha…
CVE-2026-113344High· 8.8chromium-browser: chromium-browser: Use after free in Performance (CVE-2026-113344)
CVE-2023-54156High· 7.8In the Linux kernel, the following vulnerability has been resolved: sfc: fix crash when reading stats while NIC is resetting efx_net_stats() (.ndo_get_stats64) can be called during an ethtool selftest, during which time nic_data->mc_s…
CVE-2025-68179High· 7.8In the Linux kernel, the following vulnerability has been resolved: s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP As reported by Luiz Capitulino enabling HVO on s390 leads to reproducible crashes