Junglewise Threat Intelligence

CVE-2026-43383: Linux Kernel timing attack in TCP-MD5 MAC comparison

CVE-2026-43383 · Severity: critical · CVSS 9.4 · Published 2026-05-08

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's networking component that handles secure TCP connections. By measuring the time it takes for the system to respond to certain network packets, an attacker could potentially bypass security checks. This could allow an unauthorized party to disrupt network traffic or spoof communications on systems using MD5-protected TCP sessions, such as those often used for critical internet routing (BGP).

Technical details

The vulnerability is a timing side-channel in the net/tcp-md5 component of the Linux kernel. The root cause is the use of 'memcmp()' instead of a constant-time comparison function like 'crypto_memneq()' when validating MD5 Signature Options (RFC 2385). Because 'memcmp()' returns early upon finding a mismatch, the execution time varies based on how many bytes of the provided MAC match the expected value. A remote, unauthenticated attacker can use these timing differences to iteratively guess the valid MAC. This bypasses the integrity and authenticity protections of the TCP session, potentially allowing for session hijacking or reset attacks. The issue has been patched across multiple stable kernel branches by implementing constant-time comparison.

Affected products

  • Linux Linux Kernel 2.6.20 to 5.10.253, 5.11 to 6.1.167, 6.2 to 6.6.130, 6.7 to 6.12.78, 6.13 to 6.18.19, 6.19 to 6.19.9, 7.0-rc1, 7.0-rc2

Timeline

  • 2026-03-10: other: Patch authored by Eric Biggers
  • 2026-05-08: disclosed: CVE published
  • 2026-05-08: advisory

References

Related threats