---
id: "CVE-2026-98929"
kind: "vulnerability"
aliases: ["CVE-2026-98929"]
title: "Linux kernel: MACsec device setup can warn and report uninitialized SecY state"
severity: "unknown"
cvss: null
epss: 0.00206
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "linux-kernel", "macsec", "network"]
not_affected_if: ["no-mac-offload", "no-macsec"]
published_at: "2026-10-23T13:17:13+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98929", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98929", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: MACsec device setup can warn and report uninitialized SecY state

When a MACsec device is created over an LRO-capable lower device with IPv4 forwarding enabled, the kernel can emit a spurious WARN during registration because notifications fire before the SecY is initialized. The source text describes a kernel warning and uninitialized attributes, not a demonstrated code execution or data theft path.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the fixed kernel versions in the NVD entry; the sources do not list affected version ranges
- Check whether MACsec with MAC offload is in use with `ip -d link show` for devices of type macsec
- unknown

## Fix

- Update the Linux kernel to a release containing the upstream fix 'macsec: initialize SecY before registering the netdevice'; the sources do not give the exact version
- unknown

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98929
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98929

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

macsec: initialize SecY before registering the netdevice

Creating a MACsec device with MAC offload over an LRO-capable lower
device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4
forwarding is enabled by default.

register_netdevice() invokes inetdev_init(), which disables LRO and emits
a NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before
macsec_add_dev() initializes the SecY. key_len is still zero, so
macsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in
rtmsg_ifinfo_build_skb(), even though the skb has enough space.

Even without the warning, notifications during registration can report
uninitialized SecY attributes, including the SCI. This ordering has existed
since the driver was introduced.

Initialize the SecY and apply the new-link attributes before registration.
Move MAC address inheritance into macsec_newlink() so the SCI can also be
initialized before registration-time notifications report it. Move the
per-CPU statistics and metadata destination allocation into ndo_init(),
and release partial allocations on failure.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_