CVE-2026-63925
Received Received - Intake

MACsec Replay Protection Bypass in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn_same_half(pn, lower) is true and the XPN else-if does not fire either, leaving next_pn_halves unchanged. An attacker that captures the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association can then replay it indefinitely, since lowest_pn never rises above the captured pn and macsec_decrypt() reconstructs the same IV. Extend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt of pn == U32_MAX advances next_pn_halves to (upper + 1, 0).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63925
EUVD
EUVD-2026-45698

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Linux kernel's MACsec (Media Access Control Security) implementation. It involves a flaw in replay protection when the packet number (PN) wraps around at its maximum value (U32_MAX). When PN reaches 0xFFFFFFFF, an overflow occurs, allowing an attacker to replay a captured frame indefinitely because the system fails to advance the PN counter correctly.

Detection Guidance

This vulnerability affects the Linux kernel's MACsec implementation, specifically related to replay protection at XPN lower-PN wrap. Detection requires checking if your system is running a vulnerable kernel version and inspecting MACsec configuration for improper replay protection handling.

Impact Analysis

If you use Linux systems with MACsec enabled, an attacker could intercept and replay network traffic, bypassing security measures. This could lead to unauthorized access, data tampering, or man-in-the-middle attacks on encrypted communications.

Compliance Impact

This vulnerability could violate data integrity and confidentiality requirements in GDPR and HIPAA. Replay attacks may lead to unauthorized access to sensitive data, resulting in non-compliance with these regulations' security and privacy mandates.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to fix the MACsec replay protection issue. Verify that MACsec associations are properly configured with replay protection enabled. Monitor network traffic for unusual replayed frames on XPN associations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63925. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart