{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43383", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.006Z", "datePublished": "2026-05-08T14:21:30.704Z", "dateUpdated": "2026-08-05T12:27:41.847Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:27:41.847Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/tcp-md5: Fix MAC comparison to be constant-time\n\nTo prevent timing attacks, MACs need to be compared in constant\ntime. Use the appropriate helper function for this." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "baseScore": 9.4, "baseSeverity": "CRITICAL" }, "scenarios": [ { "lang": "en", "value": "AV:N - The vulnerable comparisons are reached by remotely supplied IPv4/IPv6 TCP packets carrying the TCP MD5 option on TCP-MD5-protected sockets, including Internet-facing BGP deployments.\nAC:L - The attacker can send repeated chosen TCP segments to the verifier and use the non-constant-time comparison as a timing oracle; there is no race or memory-layout dependency beyond the target having TCP MD5 enabled/configured.\nPR:N - The vulnerable receive path is reached before successful TCP MD5 authentication, by unauthenticated network packets; no local account or kernel privilege is required.\nUI:N - No victim user action is required once a TCP-MD5-protected service such as a BGP listener/session is exposed.\nS:U - The impact remains within the same kernel/network security authority enforcing TCP authentication for the protected connection.\nC:L - The timing side channel leaks MAC comparison progress and can enable forgery of authenticated packets, potentially exposing data available through the protected TCP session, but it does not disclose kernel memory or the MD5 key directly.\nI:H - Forging valid TCP MD5 segments can bypass the transport authentication protecting BGP or similar sessions, enabling injection or manipulation of authenticated TCP/application data.\nA:H - Forged authenticated RSTs or disruptive TCP/application traffic can tear down protected routing sessions or otherwise cause significant service disruption." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/Kconfig", "net/ipv4/tcp.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c" ], "versions": [ { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "821c8751fdeecdeecabeb11704dd33439c9e4bbc", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "ff44ec94d4fc8348600a69de0a8fa1102c23bce8", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "345a9530756528d7ca407663d659c3c40e75c3dd", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "5d305a95130a8d08b9545e47f1e18d29d59866cb", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "02669e2a4d207068edce7e8b5fafd85822018ce6", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "ae3831b44f477de048287493e184fc3ff913b624", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "b502e97e29d791ff7a8051f29a414535739be218", "status": "affected", "versionType": "git" }, { "version": "cfb6eeb4c860592edd123fdea908d23c6ad1c7dc", "lessThan": "46d0d6f50dab706637f4c18a470aac20a21900d3", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/ipv4/Kconfig", "net/ipv4/tcp.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c" ], "versions": [ { "version": "2.6.20", "status": "affected" }, { "version": "0", "lessThan": "2.6.20", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.253", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.167", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.130", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.78", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.19", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.9", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "5.10.253" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "5.15.210" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.1.167" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.6.130" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.12.78" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.18.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "6.19.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.20", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/821c8751fdeecdeecabeb11704dd33439c9e4bbc" }, { "url": "https://git.kernel.org/stable/c/ff44ec94d4fc8348600a69de0a8fa1102c23bce8" }, { "url": "https://git.kernel.org/stable/c/345a9530756528d7ca407663d659c3c40e75c3dd" }, { "url": "https://git.kernel.org/stable/c/5d305a95130a8d08b9545e47f1e18d29d59866cb" }, { "url": "https://git.kernel.org/stable/c/02669e2a4d207068edce7e8b5fafd85822018ce6" }, { "url": "https://git.kernel.org/stable/c/ae3831b44f477de048287493e184fc3ff913b624" }, { "url": "https://git.kernel.org/stable/c/b502e97e29d791ff7a8051f29a414535739be218" }, { "url": "https://git.kernel.org/stable/c/46d0d6f50dab706637f4c18a470aac20a21900d3" } ], "title": "net/tcp-md5: Fix MAC comparison to be constant-time", "x_generator": { "engine": "bippy-1.2.0" } } } }