{"id":"CVE-2026-98929","kind":"vulnerability","aliases":["CVE-2026-98929"],"related":[],"title":"Linux kernel: MACsec device setup can warn and report uninitialized SecY state","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nmacsec: initialize SecY before registering the netdevice\n\nCreating a MACsec device with MAC offload over an LRO-capable lower\ndevice triggers a warning in rtmsg_ifinfo_build_skb() when IPv4\nforwarding is enabled by default.\n\nregister_netdevice() invokes inetdev_init(), which disables LRO and emits\na NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before\nmacsec_add_dev() initializes the SecY. key_len is still zero, so\nmacsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in\nrtmsg_ifinfo_build_skb(), even though the skb has enough space.\n\nEven without the warning, notifications during registration can report\nuninitialized SecY attributes, including the SCI. This ordering has existed\nsince the driver was introduced.\n\nInitialize the SecY and apply the new-link attributes before registration.\nMove MAC address inheritance into macsec_newlink() so the SCI can also be\ninitialized before registration-time notifications report it. Move the\nper-CPU statistics and metadata destination allocation into ndo_init(),\nand release partial allocations on failure.","summary":"When a MACsec device is created over an LRO-capable lower device with IPv4 forwarding enabled, the kernel can emit a spurious WARN during registration because notifications fire before the SecY is initialized. The source text describes a kernel warning and uninitialized attributes, not a demonstrated code execution or data theft path.","severity":"unknown","cvss":null,"epss":0.00206,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","macsec","network"],"not_affected_if":["no-mac-offload","no-macsec"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the NVD entry; the sources do not list affected version ranges\n- Check whether MACsec with MAC offload is in use with `ip -d link show` for devices of type macsec\n- unknown","fix":"- Update the Linux kernel to a release containing the upstream fix 'macsec: initialize SecY before registering the netdevice'; the sources do not give the exact version\n- unknown","status":"open","published_at":"2026-10-23T13:17:13+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:58:14+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T04:58:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release containing the upstream fix 'macsec: initialize SecY before registering the netdevice'; the sources do not give the exact version\n- unknown","reach":"local","title":"Linux kernel: MACsec device setup can warn and report uninitialized SecY state","impact":"low","summary":"When a MACsec device is created over an LRO-capable lower device with IPv4 forwarding enabled, the kernel can emit a spurious WARN during registration because notifications fire before the SecY is initialized. The source text describes a kernel warning and uninitialized attributes, not a demonstrated code execution or data theft path.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","macsec","network"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel warning and inconsistent MACsec notification state","analyst_note":"Check the NVD entry and the upstream kernel commit for affected version ranges, the exploitability assessment, and whether any memory-safety consequence beyond the WARN exists.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions in the NVD entry; the sources do not list affected version ranges\n- Check whether MACsec with MAC offload is in use with `ip -d link show` for devices of type macsec\n- unknown","needs_analyst":true,"not_affected_if":["no-macsec","no-mac-offload"],"who_is_affected":"Systems that create MACsec devices with MAC offload over a lower device that supports LRO, with IPv4 forwarding enabled by default. Hosts without MACsec, or without offloaded MACsec links, have no exposure to this path, so they can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000675,"input_tokens":3629,"output_tokens":625,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98929':15A,18A 'add':146C 'address':217C 'alloc':245C,252C 'also':226C 'appli':207C 'attribut':68B,190C,212C 'build':115C,170C 'capabl':35B,106C 'chang':137C 'code':72B 'cpu':240C 'creat':30B,95C 'cve':13A,16A 'data':75B 'default':123C 'demonstr':71B 'describ':62B 'destin':244C 'dev':147C 'devic':4A,28B,37B,98C,108C 'disabl':130C 'driver':200C 'emit':45B,133C 'emsgsiz':161C 'enabl':41B,121C 'enough':177C 'even':172C,179C 'execut':73B 'exist':197C 'failur':254C 'feat':136C 'fill':142C,158C 'fire':53B 'follow':83C 'forward':40B,119C 'ifinfo':114C,169C 'includ':191C 'inetdev':127C 'info':143C,159C 'infrastructur':19B 'inherit':218C 'init':128C,248C 'initi':58B,89C,148C,203C,228C 'introduc':202C 'invok':126C 'ipv4':39B,118C 'kernel':2A,22B,43B,64B,81C 'key':151C 'len':152C 'link':211C 'linux':1A,21B,80C 'linux-kernel':20B 'lower':36B,107C 'lro':34B,105C,131C 'lro-cap':33B,104C 'mac':100C,216C 'macsec':3A,23B,27B,88C,97C,141C,145C,157C,220C 'metadata':243C 'move':215C,236C 'ndo':247C 'netdev':135C 'netdevic':94C,125C 'network':24B 'new':210C 'new-link':209C 'newlink':221C 'notif':52B,138C,183C,233C 'offload':101C 'order':195C 'partial':251C 'path':77B 'per':239C 'per-cpu':238C 'reach':140C 'regist':92C,124C 'registr':50B,185C,214C,231C 'registration-tim':230C 'releas':250C 'report':9A,187C,234C 'resolv':87C 'return':160C 'rtmsg':113C,168C 'sci':193C,224C 'seci':11A,56B,90C,150C,189C,205C 'setup':5A 'sinc':198C 'skb':116C,171C,175C 'sourc':60B 'space':178C 'spurious':47B 'state':12A 'statist':241C 'still':154C 'text':61B 'theft':76B 'though':173C 'time':232C 'trigger':109C 'trip':163C 'uniniti':10A,67B,188C 'vulner':84C 'warn':7A,48B,65B,111C,165C,182C 'without':180C 'zero':155C","nicknames":[],"mitigations":[],"who_affected":"Systems that create MACsec devices with MAC offload over a lower device that supports LRO, with IPv4 forwarding enabled by default. Hosts without MACsec, or without offloaded MACsec links, have no exposure to this path, so they can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98929","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98929","severity":null,"published_at":"2026-10-23T13:17:13+00:00","modified_at":"2026-10-23T13:17:13+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98929","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98929","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}