A flaw in the Linux kernel MACsec XPN handling, corresponding to CWE-294, allows an attacker to replay a captured frame with packet number 0xFFFFFFFF indefinitely. Because the packet number overflow disables the normal replay safeguard, the decryption routine can reuse the same initialization vector, enabling repeated processing of the original traffic.

All unpatched Linux kernel versions that omit the recent macsec commit. The vulnerability resides in the core kernel code and affects any distribution shipping that kernel without the fix, regardless of distribution.

The CVSS score of 8.1 demonstrates high severity while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to capture or inject a frame with pn == U32_MAX; after that the attacker can replay it forever. The likely attack vector is via the network where the attacker can observe or inject MACsec traffic; local exploitation is also possible if a process can manipulate packet numbers.