CVE-2026-43383
TCP MD5 Signature Verification Timing Attack Fix in Linux Kernel
Publication date: 2026-05-08
Last updated on: 2026-05-08
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
| linux_kernel | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is related to the Linux kernel's TCP MD5 implementation. Specifically, the issue was that the Message Authentication Codes (MACs) were not being compared in constant time, which could allow timing attacks. The fix involved using an appropriate helper function to ensure that MAC comparisons are done in constant time, preventing attackers from gaining information based on the time it takes to compare MACs.
How can this vulnerability impact me? :
If the MAC comparison is not done in constant time, an attacker could potentially exploit timing differences to perform a timing attack. This could allow the attacker to deduce the MAC value, compromising the integrity and authenticity of TCP connections that rely on MD5 for security.