What is the CVSS score of CVE-2026-63925?

CVE-2026-63925 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-63925?

CVE-2026-63925 is a MACsec replay-protection bypass in the Linux kernel affecting systems using Extended Packet Numbering (XPN) associations, allowing adjacent attackers to indefinitely replay…. A patch is available.

How to fix or mitigate CVE-2026-63925?

Within 24 hours, identify production systems running Linux kernel with MACsec XPN support and establish a patching baseline; immediately validate patch availability from your Linux distribution vendor for your kernel versions. Within 7 days, deploy the vendor-released patch through your lab/staging environment, verifying no regression in MACsec functionality with XPN associations. Within 30 days, execute a phased rollout of the patch to production systems according to your change management process, prioritizing any systems actively using MACsec with XPN on critical network segments.

Linux Kernel CVE-2026-63925

EUVD-2026-45698 HIGH

2026-07-19 Linux

GHSA-9hhm-2pf7-p38c

Buffer Overflow Linux

8.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

vuln.today AI

8.1 HIGH

Adjacent-only L2 capture/replay with no privileges (AV:A/PR:N); replay breaks message integrity and can disrupt the flow (I:H/A:H) but discloses nothing (C:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

4.0 AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:22 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.1 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.1

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

macsec: fix replay protection at XPN lower-PN wrap

In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If next_pn_halves.lower is also in the upper half, pn_same_half(pn, lower) is true and the XPN else-if does not fire either, leaving next_pn_halves unchanged. An attacker that captures the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association can then replay it indefinitely, since lowest_pn never rises above the captured pn and macsec_decrypt() reconstructs the same IV.

Extend the XPN else-if to also fire when pn + 1 wraps to 0, so receipt of pn == U32_MAX advances next_pn_halves to (upper + 1, 0).

AnalysisAI

MACsec replay-protection bypass in the Linux kernel allows an adjacent attacker to indefinitely replay a captured frame on Extended Packet Numbering (XPN) associations. Because macsec_post_decrypt() computes pn + 1 on a u32, the value 0xFFFFFFFF wraps to 0 and fails to advance next_pn_halves, so lowest_pn never rises and the same IV keeps validating. EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis, but the CVSS of 8.1 reflects high integrity and availability impact against encrypted L2 links.

Technical ContextAI

MACsec (IEEE 802.1AE) provides Layer-2 encryption and integrity between adjacent nodes; XPN (Extended Packet Numbering, 64-bit) is used on high-speed links where a 32-bit packet number would exhaust too quickly. Anti-replay is enforced by tracking the highest seen packet number split into two 32-bit halves (next_pn_halves.lower/upper) and rejecting frames below lowest_pn. The defect is an unsigned 32-bit integer wraparound (CWE-190) that produces a capture-replay authentication bypass (CWE-294): when pn == U32_MAX, pn + 1 overflows to 0, the first advancement branch is skipped, and pn_same_half() keeps the XPN else-if from firing, so the receiver never rolls the upper half or resets the lower window. The kernel-supplied CWE is N/A and the intelligence 'Buffer Overflow' tag is a misclassification - this is not a memory-safety/buffer overflow but an arithmetic-overflow-driven replay flaw. Affected code path is macsec_post_decrypt()/macsec_decrypt() in the kernel MACsec driver.

RemediationAI

Primary fix: upgrade to a patched stable kernel for your series - Vendor-released patch: 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 (pick the point release matching your branch), or pull the corresponding fix commits from https://git.kernel.org/stable (e.g. dd7306779c6ce1238f4cdc34f3c1f2246b854457) which extend the XPN else-if to also advance next_pn_halves when pn + 1 wraps to 0. Where immediate patching is not possible, compensating controls include not deploying XPN cipher suites on exposed segments (fall back to standard 32-bit PN MACsec where operationally acceptable, at the cost of more frequent SAK rekeying), rotating the Secure Association Key more frequently so a given SA does not linger near the pn == U32_MAX boundary, and tightening physical/L2 access to trusted ports and 802.1X-authenticated links to deny the adjacent capture position (trade-off: added rekey and access-control overhead). Verify affected-version details against the vendor advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-63925 and EUVD-2026-45698.

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-63925 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-63925

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code