CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-md5: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2
Event History
Frequently Asked Questions
What exposure is required for exploitation?
The issue is remotely exploitable with low attack complexity and requires neither authentication nor user interaction, according to the supplied CVSS vector. It affects TCP-MD5 MAC comparison behavior in the Linux kernel.
What is the security impact?
A non-constant-time MAC comparison can expose timing information during MAC validation. The supplied severity data rates the issue critical at 9.4, with low confidentiality impact and high integrity and availability impact.
How can this be mitigated if an update cannot be applied immediately?
The provided information does not identify a configuration workaround. The documented fix is to use a constant-time helper function for TCP-MD5 MAC comparison.