CVE-2026-68119

Received Received - Intake

TCP-AO Response Padding Uninitialized in Linux Kernel

Publication date: 2026-08-10

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the option rounded up to a four-byte boundary. tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not four-byte aligned, the one to three bytes after the MAC are left uninitialized and may be transmitted. For the normal TCP-AO hashing mode, those bytes also have to be initialized before computing the MAC. Initialize only the alignment padding in the TCP-AO branches, before hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path. This avoids adding work to non-AO TCP responses while preserving a valid authenticated header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-17

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-68119

EUVD

EUVD-2026-55500

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves uninitialized memory being transmitted in TCP-AO (TCP Authentication Option) responses. When constructing standalone TCP responses with TCP-AO options, the MAC length may not align to four-byte boundaries, leaving one to three bytes uninitialized after the MAC. These bytes could be sent in network traffic, potentially exposing sensitive data.

Detection Guidance

This vulnerability affects TCP-AO (TCP Authentication Option) handling in the Linux kernel. Detection requires checking if your system uses TCP-AO and if the kernel version is vulnerable. Use uname -a to check the kernel version and grep for TCP-AO support in kernel configs. No direct commands detect this specific issue as it involves uninitialized memory in TCP responses.

Impact Analysis

The impact includes potential exposure of sensitive information if uninitialized memory containing residual data is transmitted. Attackers might intercept this data during network communication, leading to information leakage. Systems using TCP-AO for authentication could be affected.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves uninitialized memory in TCP-AO response padding in the Linux kernel, which could potentially expose sensitive data in network traffic. However, no evidence suggests this is a compliance violation in itself.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve this issue. Disable TCP-AO if not required, as it is not widely deployed. Monitor vendor advisories for updates and test patches in a non-production environment before full deployment.

Hi! I’m here to help you understand CVE-2026-68119. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70