VulnerabilityPublished 23 Oct 2026

CVE-2026-98929: Linux kernel · macsec: initialize SecY before registering the netdevice

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in c2de369c5c5b8599ca10fd5ca8d11fcd845c1331 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 13:07 UTC

Severity

Unrated

Rated by Threat Radar · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in c2de369c5c5b8599ca10fd5ca8d11fcd845c1331, b07bea42bf590edb0fd507ab25622a74af09548b, 2b42adf3b8ee9a0e1d2629aca3c5a02a1c438066

Exploitation evidence

Disclosed: evidence found.
CVE published 23 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade Linux kernel to c2de369c5c5b8599ca10fd5ca8d11fcd845c1331, b07bea42bf590edb0fd507ab25622a74af09548b or 2b42adf3b8ee9a0e1d2629aca3c5a02a1c438066.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ c09440f7dcb304002dfced8c0fea289eb25f2da0, < c2de369c5c5b8599ca10fd5ca8d11fcd845c1331	Fixed in c2de369c5c5b8599ca10fd5ca8d11fcd845c1331
LinuxLinux	Affected ≥ c09440f7dcb304002dfced8c0fea289eb25f2da0, < b07bea42bf590edb0fd507ab25622a74af09548b	Fixed in b07bea42bf590edb0fd507ab25622a74af09548b
LinuxLinux	Affected ≥ c09440f7dcb304002dfced8c0fea289eb25f2da0, < 2b42adf3b8ee9a0e1d2629aca3c5a02a1c438066	Fixed in 2b42adf3b8ee9a0e1d2629aca3c5a02a1c438066
LinuxLinux	Affected =4.6	Fixed in–

Description

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsg_ifinfo_build_skb() when IPv4 forwarding is enabled by default. register_netdevice() invokes inetdev_init(), which disables LRO and emits a NETDEV_FEAT_CHANGE notification. This reaches macsec_fill_info() before macsec_add_dev() initializes the SecY. key_len is still zero, so macsec_fill_info() returns -EMSGSIZE and trips the WARN_ON in rtmsg_ifinfo_build_skb(), even though the skb has enough space. Even without the warning, notifications during registration can report uninitialized SecY attributes, including the SCI. This ordering has existed since the driver was introduced. Initialize the SecY and apply the new-link attributes before registration. Move MAC address inheritance into macsec_newlink() so the SCI can also be initialized before registration-time notifications report it. Move the per-CPU statistics and metadata destination allocation into ndo_init(), and release partial allocations on failure.

References

Community reviews

Loading reviews…