Re: [PATCH net] macsec: fix replay protection at XPN lower-PN wrap

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@xxxxxxxxxx>:

On Wed, 20 May 2026 11:47:55 +0800 you wrote:
> In macsec_post_decrypt(), when pn is U32_MAX, pn + 1 overflows u32 to 0
> and the first branch never fires. If next_pn_halves.lower is also in the
> upper half, pn_same_half(pn, lower) is true and the XPN else-if does not
> fire either, leaving next_pn_halves unchanged. An attacker that captures
> the legitimate frame carrying pn == 0xFFFFFFFF on an XPN association
> can then replay it indefinitely, since lowest_pn never rises above
> the captured pn and macsec_decrypt() reconstructs the same IV.
> 
> [...]

Here is the summary with links:
  - [net] macsec: fix replay protection at XPN lower-PN wrap
    https://git.kernel.org/netdev/net/c/e68842b33564

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html