{"id":"CVE-2026-63925","revision":"8084a2cc22c046f6ad8110900ebad9f5","records":[{"revision":"8084a2cc22c046f6ad8110900ebad9f5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63925","aliases":[],"title":"macsec: fix replay protection at XPN lower-PN wrap","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmacsec: fix replay protection at XPN lower-PN wrap\n\nIn macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0\nand the first branch never fires. If next_pn_halves.lower is also in the\nupper half, pn_same_half(pn, lower) is true and the XPN else-if does not\nfire either, leaving next_pn_halves unchanged. An attacker that captures\nthe legitimate frame carrying pn == 0xFFFFFFFF on an XPN association\ncan then replay it indefinitely, since lowest_pn never rises above\nthe captured pn and macsec_decrypt() reconstructs the same IV.\n\nExtend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt\nof pn == U32_MAX advances next_pn_halves to (upper + 1, 0).","state":0,"publishedAt":"2026-07-19T14:55:26.442+00:00","modifiedAt":"2026-10-19T20:17:57.078+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/macsec.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"dd7306779c6ce1238f4cdc34f3c1f2246b854457\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"d15130461df388136b62a7b0ce9f66e7e2fa9ff1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"23c0e230eab397d7f68be2538790ac41d3bb91fd\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"679e13a65e68a67c8b3c0467c02ee89157ec6f0f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"79495a1b0944fe31ffd54b54b00211b493590d62\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"d55acbe577db892b60547b6ef1c020b359331a6d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"a21ecf0e033807b976967286e6c392f48ee2049f\",\n                            \"lessThan\": \"e68842b3356471ba56c882209f324613dac47f64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/net/macsec.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.259\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.93\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.35\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.12\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","score":8.1,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/dd7306779c6ce1238f4cdc34f3c1f2246b854457","https://git.kernel.org/stable/c/d15130461df388136b62a7b0ce9f66e7e2fa9ff1","https://git.kernel.org/stable/c/23c0e230eab397d7f68be2538790ac41d3bb91fd","https://git.kernel.org/stable/c/679e13a65e68a67c8b3c0467c02ee89157ec6f0f","https://git.kernel.org/stable/c/79495a1b0944fe31ffd54b54b00211b493590d62","https://git.kernel.org/stable/c/6d00f5c7e5ff7ec4795b7f5f8ed88bd346641652","https://git.kernel.org/stable/c/d55acbe577db892b60547b6ef1c020b359331a6d","https://git.kernel.org/stable/c/e68842b3356471ba56c882209f324613dac47f64"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63925","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63925","identifiers":["CVE-2026-63925"]},"retained":false,"historicalAffected":[]}],"coverage":[]}