CVE-2026-68119tcp: initialize standalone TCP-AO response padding
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the option rounded up to a four-byte boundary. tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not four-byte aligned, the one to three bytes after the MAC are left uninitialized and may be transmitted. For the normal TCP-AO hashing mode, those bytes also have to be initialized before computing the MAC. Initialize only the alignment padding in the TCP-AO branches, before hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path. This avoids adding work to non-AO TCP responses while preserving a valid authenticated header.
- CVSS
- 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from decde2586b34b99684faff1eab41e5c496c27fb6 before bbb7db8c74b0b5d17a695136f0f0806ecd0118f6; from decde2586b34b99684faff1eab41e5c496c27fb6 before fadaff3f66e124c3a62237f9c881819a8ac90309; from decde2586b34b99684faff1eab41e5c496c27fb6 before a859b280441fb02f64ed4037f03d5c0c34a7a595; from decde2586b34b99684faff1eab41e5c496c27fb6 before e1a9d3cc11829c5414a75eb39c704f461936eb24 | CNA record |
References
- https://git.kernel.org/stable/c/bbb7db8c74b0b5d17a695136f0f0806ecd0118f6
- https://git.kernel.org/stable/c/fadaff3f66e124c3a62237f9c881819a8ac90309
- https://git.kernel.org/stable/c/a859b280441fb02f64ed4037f03d5c0c34a7a595
- https://git.kernel.org/stable/c/e1a9d3cc11829c5414a75eb39c704f461936eb24
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.