CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time
In the Linux kernel, the following vulnerability has been resolved:
net/tcp-ao: Fix MAC comparison to be constant-time
To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using TCP Authentication Option (TCP-AO) are the relevant exposure area, because the affected code is in net/tcp-ao. The provided information does not identify specific kernel versions or whether TCP-AO is enabled by default.
What does an attacker need to exploit it?
The issue is a timing side channel in TCP-AO MAC comparison. The supplied data indicates it can be exploited remotely without privileges or user interaction, but does not specify the traffic conditions or observations required to recover useful MAC information.
How can I determine whether my system has the fix?
Check whether your kernel includes one of the referenced stable commits: 8be6ed64966da48b6c4726918f106c18742a5125, a269cbdc442f8658bca35383e34b9d0b0ff95a1c, or 080b0e210088296dd50d6637c06c1db14246adfe. These changes replace the MAC comparison with a constant-time comparison.