The Linux kernel macsec module had a flaw in its replay protection mechanism for Extended Packet Number (XPN) associations. Specifically, when the packet number reaches the maximum 32-bit unsigned integer value (U32_MAX), incrementing it causes an overflow to zero, but the existing logic did not update the replay protection state accordingly. This allowed an attacker who captured a legitimate frame with pn == 0xFFFFFFFF to replay it indefinitely, as the lowest packet number never advanced and the decryption initialization vector (IV) was reconstructed identically. The fix involved modifying the XPN else-if condition to handle the wrap-around case, ensuring that receipt of pn == U32_MAX properly advances the replay protection state.

An attacker capable of capturing a legitimate macsec frame with the maximum packet number could replay that frame indefinitely, bypassing replay protection. This undermines the integrity guarantees of macsec by allowing replayed frames to be accepted and decrypted as valid, potentially leading to unauthorized data injection or replay attacks on the protected network traffic.

A fix for this vulnerability has been implemented in the Linux kernel macsec code. Users should apply the official kernel updates that include this patch. Since no specific patch versions are provided, check the vendor or Linux kernel security advisories for the relevant fixed kernel versions and update accordingly.