Riskcovery

CVE-2026-43384

net/tcp-ao: Fix MAC comparison to be constant-time

State
Published
Severity
9.8 Critical
Published
May 8, 2026
Updated
Aug 5, 2026
Reserved
May 1, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

net/tcp-ao: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 0a3a809089eb1d4a0a2fd0c16b520d603988c859 to before 8be6ed64966da48b6c4726918f106c18742a5125Affected
  • 0a3a809089eb1d4a0a2fd0c16b520d603988c859 to before a269cbdc442f8658bca35383e34b9d0b0ff95a1cAffected
  • 0a3a809089eb1d4a0a2fd0c16b520d603988c859 to before 080b0e210088296dd50d6637c06c1db14246adfeAffected
  • 0a3a809089eb1d4a0a2fd0c16b520d603988c859 to before 67edfec516d30d3e62925c397be4a1e5185802fcAffected
LinuxLinux
  • 6.7Affected
  • before 6.7Not affected
  • 6.12.78 through 6.12.*Not affected
  • 6.18.19 through 6.18.*Not affected
  • 6.19.9 through 6.19.*Not affected
  • 7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.