CVE-2026-72049

In the Linux kernel, the following vulnerability has been resolved:

ieee802154: admin-gate legacy LLSEC dump operations

In net/ieee802154/netlink.c, the legacy IEEE802154NL family ops table builds the LLSEC dump entries (LLSECLISTKEY, LLSECLISTDEV, LLSECLISTDEVKEY, LLSECLISTSECLEVEL) with IEEE802154DUMP() which sets no .flags, so generic netlink runs them ungated. The modern nl802154 family admin-gates the equivalent reads via NL802154CMDGETSECKEY and friends with .flags = GENLADMINPERM.

Any local uid that can open AFNETLINK / NETLINKGENERIC can resolve the "802.15.4 MAC" family and dump LLSECLISTKEY on any wpan netdev that has an LLSEC key installed; the dump handler writes the raw 16-byte AES-128 key bytes (IEEE802154ATTRLLSECKEYBYTES, copied verbatim from struct ieee802154llseckey.key) into the reply. Recovering the AES key compromises 802.15.4 LLSEC link confidentiality and authenticity, since LLSEC uses CCM* and the same key authenticates and encrypts frames.

Impact: any local uid with no capabilities can read the raw 16-byte AES-128 LLSEC key from the kernel keytable on any wpan netdev that has an administrator-installed LLSEC key, by issuing an LLSECLISTKEY dump on the legacy IEEE802154_NL generic-netlink family.

Introduce IEEE802154DUMPPRIV() mirroring IEEE802154DUMP() but setting .flags = GENLADMINPERM, and use it for the four LLSEC dump entries. LISTPHY and LISTIFACE retain IEEE802154DUMP() because the modern nl802154 family exposes their equivalents to unprivileged readers by design (NL802154CMDGETWPANPHY and NL802154CMDGET_INTERFACE carry "can be retrieved by unprivileged users" annotations).