Linux MACsec (replay protection at XPN lower-PN wrap): TENANT ISOLATION: MACsec replay protection fails

Impact

TENANT ISOLATION: MACsec replay protection fails at the extended-packet-number lower-PN wrap. When the packet number is U32_MAX the increment overflows to zero and neither replay branch fires, so next_pn_halves is never advanced — an attacker who captured legitimate ciphertext can replay it and have it accepted. Replay protection is the property that stops a passive observer from becoming an active injector on an encrypted link; losing it turns a tap into a traffic-injection capability on links that carry multiple tenants.

Who can reach it

An attacker who can capture and re-transmit frames on a MACsec-protected link, timed to the PN wrap. Passive tap plus injection capability, no keys required.

What to do

Kernel upgrade plus host reboot on any node terminating software MACsec (switch NOSes based on Linux included, where it arrives as a NOS image update plus reload). No config workaround — you cannot turn replay protection back on if the check itself is broken. Companion Linux MACsec issues in the same window: CVE-2026-72019, CVE-2022-48720.

References