CVE-2026-72049

This CVE exposes a privilege-escalation gap between two IEEE 802.15.4 netlink families that serve the same subsystem. The modern nl802154 family correctly gates raw AES-128 key dumps behind GENL_ADMIN_PERM, requiring CAP_NET_ADMIN. The legacy IEEE802154_NL family — which predates nl802154 and shares no code ancestry — exposes the same key material to any local user because its dump operations carry no permission flag. This is not a memory corruption bug; it's a security boundary bypass through deprecated code paths. The vulnerability has physical-world implications that CVSS 7.1 obscures. LLSEC in 802.15.4 uses CCM* with a single key for both authentication and encryption across an entire link layer. Leaking that key compromises every frame on that WPAN interface until rotation — not just one session. If that interface connects industrial sensors, building automation, or medical devices, the impact extends into operational and safety domains. The patch adds a new IEEE802154_DUMP_PRIV() macro to gate the four LLSEC dump entries while preserving ungated behavior for LIST_PHY and LIST_IFACE. This is the correct immediate fix, but it introduces a semantic split: two dump macros with different access expectations. Future developers adding new dump operations must choose correctly each time, and nothing enforces that choice. The deeper concern is structural. This is the same pattern seen across cfg80211/WEXT, legacy crypto interfaces, and older platform bus paths — modern replacements get proper access control while legacy equivalents persist frozen in their original permission model. The kernel lacks any mechanism to flag 'you just hardened family X, did you check its legacy equivalent?' When LLSEC support was wired into IEEE802154_NL, nobody compared the security posture to nl802154. Audit your kernel deployments for other legacy netlink families that expose sensitive material (keys, credentials, hardware identifiers) through paths that their modern equivalents gate properly. If nl802154 fully covers the LLSEC surface, the IEEE802154_NL family should be deprecated or restricted to root-only sockets rather than maintained in parallel.

Reviewed through automated stages and approved by a human before publication.