A high-severity flaw in the Linux kernel MACsec implementation could allow an adjacent attacker to bypass replay protection mechanisms.

The vulnerability occurs in macsec_post_decrypt when the packet number reaches U32_MAX, causing an overflow that prevents the replay protection branch from executing. This allows an attacker with adjacent access to potentially replay or manipulate encrypted traffic.

Exploitation of this flaw undermines the security guarantees of MACsec, which is intended to protect traffic at the data link layer. This could lead to the integrity of network communications being compromised, potentially allowing for unauthorized data injection or replay attacks against sensitive internal services.

Immediate Action: Update the kernel to version 5.10.259, 5.15.210, 6.1.176, or later, as recommended by your Linux distribution provider.

Proactive Monitoring: Review network traffic patterns for anomalies that might indicate replay attempts on MACsec-secured links.

Compensating Controls: Ensure that additional layers of encryption, such as TLS or IPsec, are employed to protect data even if the underlying link-layer security is bypassed.

Public Exploit Available: unknown

While the complexity of exploiting this flaw is relatively high, the impact on network-level security is severe. Administrators are strongly advised to update their systems to the latest stable kernel versions to ensure that MACsec replay protection functions correctly under all packet number conditions.