CVE-2025-40204

sctp: Fix MAC comparison to be constant-time

State: Published
Severity: 8.1 High
Published: Nov 12, 2025
Updated: Oct 15, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

sctp: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b93fa8dc521d00d2d44bf034fb90e0d79b036617Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0e8b8c326c2a6de4d837b1bb034ea704f4690d77Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1cd60e0d0fb8f0e62ec4499138afce6342dc9d4cAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9c05d44ec24126fc283835b68f82dba3ae985209Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ed3044b9c810c5c24eb2830053fbfe5fd134c5d4Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8019b3699289fce3f10b63f98601db97b8d105b0Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0b32ff285ff6f6f1ac1d9495787ccce8837d6405Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dd91c79e4f58fbe2898dac84858033700e0e99fbAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 5.4.301 through 5.4.Not affected 5.10.246 through 5.10.Not affected 5.15.195 through 5.15.Not affected 6.1.157 through 6.1.Not affected 6.6.113 through 6.6.Not affected 6.12.54 through 6.12.Not affected 6.17.4 through 6.17.*Not affected 6.18 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before b93fa8dc521d00d2d44bf034fb90e0d79b036617Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0e8b8c326c2a6de4d837b1bb034ea704f4690d77Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 1cd60e0d0fb8f0e62ec4499138afce6342dc9d4cAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 9c05d44ec24126fc283835b68f82dba3ae985209Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before ed3044b9c810c5c24eb2830053fbfe5fd134c5d4Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 8019b3699289fce3f10b63f98601db97b8d105b0Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 0b32ff285ff6f6f1ac1d9495787ccce8837d6405Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before dd91c79e4f58fbe2898dac84858033700e0e99fbAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
5.4.301 through 5.4.*Not affected
5.10.246 through 5.10.*Not affected
5.15.195 through 5.15.*Not affected
6.1.157 through 6.1.*Not affected
6.6.113 through 6.6.*Not affected
6.12.54 through 6.12.*Not affected
6.17.4 through 6.17.*Not affected
6.18 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.