Security readout for executives and security teams
Plain-English summary
Linux TCP Authentication Option code compared authentication tags in a way that could leak information through response timing. An attacker able to collect sufficiently precise measurements might infer authentication information, weakening protected TCP sessions. The supplied record rates this critical, but it provides no evidence of successful exploitation or broad real-world impact.
Executive priority
Prioritize rapid exposure assessment because the supplied CVSS is 9.8, while calibrating urgency to actual TCP-AO use. Patch reachable TCP-AO deployments through supported vendor channels promptly. Broad emergency action across Linux estates is not justified by the bundle alone without confirming that the vulnerable feature is used.
Technical view
The Linux kernel TCP-AO implementation used a non-constant-time MAC comparison. Differences in comparison time can create a side channel when processing attacker-controlled authentication tags. The referenced stable-kernel changes replace that comparison with an appropriate constant-time helper. The bundle does not establish practical attack requirements, measurement reliability, or demonstrated key recovery.
Likely exposure
Exposure is most relevant to Linux systems using TCP-AO on attacker-reachable TCP connections. Systems not using TCP-AO are unlikely to exercise the vulnerable comparison path. The supplied version data is ambiguous and includes hashes and loosely structured releases, so confirm exposure using distribution-specific advisories and kernel package mappings.
Exploitation context
The record is not listed in KEV, and the supplied sources do not report active exploitation or a public proof of concept. Exploitation of a timing side channel would generally require repeated interactions and sufficiently reliable timing observations. Practical feasibility across real networks is not established by this bundle.
Researcher notes
The core defect is a timing-sensitive equality check in TCP-AO MAC verification. The bundle identifies four stable-kernel fixes but does not clearly map every affected or corrected release. Treat practical exploitability, required sample volume, network-noise tolerance, and security impact as unresolved research questions; do not interpret the CVSS vector as proof of demonstrated compromise.
Mitigation direction
- Apply a vendor-supported kernel update containing the referenced constant-time comparison fix.
- Check Linux distribution advisories for package-specific fixed versions and backports.
- Restrict attacker reachability to TCP-AO-protected endpoints where operationally feasible.
- Review whether TCP-AO is enabled and required on affected systems.
Validation and detection
- Inventory running kernel versions on systems that configure or use TCP-AO.
- Map installed kernel packages against distribution advisories and referenced stable commits.
- Confirm updated kernels are running after patching, including following required reboots.
- Verify the TCP-AO MAC comparison uses the constant-time helper in maintained source packages.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2026-43384 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9LinuxVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/8be6ed64966da48b6c4726918f106c18742a5125CVE reference, Linux
- https://git.kernel.org/stable/c/a269cbdc442f8658bca35383e34b9d0b0ff95a1cCVE reference, Linux
- https://git.kernel.org/stable/c/080b0e210088296dd50d6637c06c1db14246adfeCVE reference, Linux
- https://git.kernel.org/stable/c/67edfec516d30d3e62925c397be4a1e5185802fcCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.