Live › vulnerability › CVE-2026-98929
Go to dashboardWhen a MACsec device is created over an LRO-capable lower device with IPv4 forwarding enabled, the kernel can emit a spurious WARN during registration because notifications fire before the SecY is initialized. The source text describes a kernel warning and uninitialized attributes, not a demonstrated code execution or data theft path.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems that create MACsec devices with MAC offload over a lower device that supports LRO, with IPv4 forwarding enabled by default. Hosts without MACsec, or without offloaded MACsec links, have no exposure to this path, so they can skip it.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel versions in the NVD entry; the sources do not list affected version rangesip -d link show for devices of type macsecEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
macsec: initialize SecY before registering the netdevice
Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default.
register_netdevice() invokes inetdev_init(), which disables LRO and emits a NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before macsec_add_dev() initializes the SecY. key_len is still zero, so macsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in rtmsg_ifinfo_build_skb(), even though the skb has enough space.
Even without the warning, notifications during registration can report uninitialized SecY attributes, including the SCI. This ordering has existed since the driver was introduced.
Initialize the SecY and apply the new-link attributes before registration. Move MAC address inheritance into macsec_newlink() so the SCI can also be initialized before registration-time notifications report it. Move the per-CPU statistics and metadata destination allocation into ndo_init(), and release partial allocations on failure.
This page as .md · .json · in your agent: get_signal("CVE-2026-98929")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.