The CVSS 7.3 for CVE-2026-72019 significantly understates the actual risk profile. This is not a conventional kernel heap information disclosure where an attacker must build a separate exfiltration channel to read whatever bytes landed adjacent to the vulnerable buffer. The 12-byte out-of-bounds read in macsec_encrypt() on the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS path is emitted directly as the outer Ethernet header of the transmitted frame. The disclosure and the transmission are the same event — any kernel heap contents occupying those 12 bytes after skb->head are broadcast to every node on the L2 segment, the VLAN, or the virtual switch port. This is qualitatively a wire-level data injection, not a passive read.
In virtualized or cloud environments, the blast radius extends further: an adjacent VM on the same hypervisor host can collect leaked heap bytes without being on the same virtual network, simply by sharing the same NUMA node or through adjacent memory access patterns. The traditional model of "attacker must be on the same collision domain" fractures into "attacker must be co-resident on the same physical host."
The trigger constraints — CAP_NET_RAW capability and the PACKET_QDISC_BYPASS fast path — are less restrictive than they appear. Modern containerized deployments routinely grant CAP_NET_RAW to pods, development containers, and observability agents. In high-throughput networking stacks, PACKET_QDISC_BYPASS is often the default, not a niche opt-in.
The kernel already has the safe API: skb_eth_hdr() was introduced to handle exactly this mac_header-unset TX scenario when macvlan encountered the same bug in commit 96cc4b69581d. The macsec vulnerability is a genetic sibling of that macvlan bug — same eth_hdr() misuse on the same TX fast path, despite the fix already existing in-tree. This wasn't bad luck; it's a systemic pattern where regression fixes address symptoms without triggering class-wide audits of similar call sites.
For defenders: audit your AF_PACKET SOCK_RAW configurations, review whether CAP_NET_RAW is granted more broadly than necessary, and treat any macsec-enabled interface as potentially leaking adjacent heap state until patched. The wire emission also creates a detection signature — any IDS monitoring L2 traffic can flag frames with anomalous outer headers from macsec sources. This bug is more observable to defenders than a typical kernel info-disclosure, which should factor into your prioritization calculus.