CVE-2026-63925

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the macsec post decrypt() function where a replay protection failure occurs during an Extended Packet Number (XPN) lower-PN wrap. When the packet number pn reaches U32 MAX, the calculation pn + 1 overflows to 0, preventing the expected logic branch from executing. If next pn halves.lower is also in the upper half, the pn same half(pn, lower) check returns true, and the XPN logic is bypassed, leaving next pn halves unchanged. This allows an attacker to capture a legitimate frame with pn equal to 0xFFFFFFFF and replay it indefinitely, as the lowest pn does not increase and macsec decrypt() continues to reconstruct the same Initialization Vector (IV).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.