CVE-2026-68119 (GCVE-0-2026-68119)

Vulnerability from cvelistv5 – Published: 2026-08-10 11:58 – Updated: 2026-08-17 04:59
VLAI
Title
tcp: initialize standalone TCP-AO response padding
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the option rounded up to a four-byte boundary. tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not four-byte aligned, the one to three bytes after the MAC are left uninitialized and may be transmitted. For the normal TCP-AO hashing mode, those bytes also have to be initialized before computing the MAC. Initialize only the alignment padding in the TCP-AO branches, before hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path. This avoids adding work to non-AO TCP responses while preserving a valid authenticated header.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: decde2586b34b99684faff1eab41e5c496c27fb6 , < bbb7db8c74b0b5d17a695136f0f0806ecd0118f6 (git)
Affected: decde2586b34b99684faff1eab41e5c496c27fb6 , < fadaff3f66e124c3a62237f9c881819a8ac90309 (git)
Affected: decde2586b34b99684faff1eab41e5c496c27fb6 , < a859b280441fb02f64ed4037f03d5c0c34a7a595 (git)
Affected: decde2586b34b99684faff1eab41e5c496c27fb6 , < e1a9d3cc11829c5414a75eb39c704f461936eb24 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.7
Unaffected: 0 , < 6.7 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c",
            "net/ipv6/tcp_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "bbb7db8c74b0b5d17a695136f0f0806ecd0118f6",
              "status": "affected",
              "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
              "versionType": "git"
            },
            {
              "lessThan": "fadaff3f66e124c3a62237f9c881819a8ac90309",
              "status": "affected",
              "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
              "versionType": "git"
            },
            {
              "lessThan": "a859b280441fb02f64ed4037f03d5c0c34a7a595",
              "status": "affected",
              "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
              "versionType": "git"
            },
            {
              "lessThan": "e1a9d3cc11829c5414a75eb39c704f461936eb24",
              "status": "affected",
              "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_ipv4.c",
            "net/ipv6/tcp_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.7"
            },
            {
              "lessThan": "6.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: initialize standalone TCP-AO response padding\n\ntcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP\nresponses with TCP-AO options.  The option length carries the actual MAC\nlength, but the TCP header length includes the option rounded up to a\nfour-byte boundary.\n\ntcp_ao_hash_hdr() writes the MAC only.  Thus, when the MAC length is not\nfour-byte aligned, the one to three bytes after the MAC are left\nuninitialized and may be transmitted.  For the normal TCP-AO hashing\nmode, those bytes also have to be initialized before computing the MAC.\n\nInitialize only the alignment padding in the TCP-AO branches, before\nhashing the header.  Use TCPOPT_NOP, as in the normal TCP-AO output path.\nThis avoids adding work to non-AO TCP responses while preserving a valid\nauthenticated header."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Remote attackers reach tcp_v4_send_ack() and tcp_v6_send_response() by sending IPv4/IPv6 TCP segments into tcp_v4_rcv()/tcp_v6_rcv() SYN-RECV, TIME-WAIT, and reset paths that build standalone TCP-AO-signed ACK/RST replies transmitted back over the network.\nAC:L - On Internet-facing TCP-AO deployments (BGP/route-server successors to TCP-MD5), an attacker reliably elicits qualifying standalone responses by sending crafted TCP segments; no race, timing lottery, or uncontrollable memory layout is required beyond the peer using a non-4-byte-aligned MAC length.\nPR:N - The uninitialized bytes are returned to the remote packet sender in standalone TCP-AO ACK/RST replies; triggering requires only network reachability to a TCP-AO-enabled listener or an existing TCP-AO TIME-WAIT socket, with no local credentials on the victim host.\nUI:N - No end-user action is needed beyond normal exposure of a TCP-AO-protected network service; the attacker alone sends the triggering TCP segments and captures the padded replies.\nS:U - Kernel stack or skb memory is disclosed to a remote TCP peer within the same host kernel security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - One to three uninitialized bytes in TCP-AO option alignment padding from the on-stack IPv4 response buffer or IPv6 skb head are transmitted on every qualifying standalone ACK/RST and can be harvested repeatedly to recover kernel stack or skb contents.\nI:N - The bug only fails to initialize alignment padding before transmission; it does not write to or corrupt kernel, socket, or application memory.\nA:N - Standalone TCP-AO responses are still transmitted successfully with no kernel oops, panic, hang, or denial of service; only confidentiality of the leaked padding bytes is affected."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:59:09.650Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/bbb7db8c74b0b5d17a695136f0f0806ecd0118f6"
        },
        {
          "url": "https://git.kernel.org/stable/c/fadaff3f66e124c3a62237f9c881819a8ac90309"
        },
        {
          "url": "https://git.kernel.org/stable/c/a859b280441fb02f64ed4037f03d5c0c34a7a595"
        },
        {
          "url": "https://git.kernel.org/stable/c/e1a9d3cc11829c5414a75eb39c704f461936eb24"
        }
      ],
      "title": "tcp: initialize standalone TCP-AO response padding",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68119",
    "datePublished": "2026-08-10T11:58:39.026Z",
    "dateReserved": "2026-07-30T09:28:09.369Z",
    "dateUpdated": "2026-08-17T04:59:09.650Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68119",
      "date": "2026-09-21",
      "epss": "0.00373",
      "percentile": "0.31063"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp_ipv4.c",
                  "net/ipv6/tcp_ipv6.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "bbb7db8c74b0b5d17a695136f0f0806ecd0118f6",
                    "status": "affected",
                    "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fadaff3f66e124c3a62237f9c881819a8ac90309",
                    "status": "affected",
                    "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a859b280441fb02f64ed4037f03d5c0c34a7a595",
                    "status": "affected",
                    "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e1a9d3cc11829c5414a75eb39c704f461936eb24",
                    "status": "affected",
                    "version": "decde2586b34b99684faff1eab41e5c496c27fb6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/tcp_ipv4.c",
                  "net/ipv6/tcp_ipv6.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.7"
                  },
                  {
                    "lessThan": "6.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.42",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: initialize standalone TCP-AO response padding\n\ntcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP\nresponses with TCP-AO options.  The option length carries the actual MAC\nlength, but the TCP header length includes the option rounded up to a\nfour-byte boundary.\n\ntcp_ao_hash_hdr() writes the MAC only.  Thus, when the MAC length is not\nfour-byte aligned, the one to three bytes after the MAC are left\nuninitialized and may be transmitted.  For the normal TCP-AO hashing\nmode, those bytes also have to be initialized before computing the MAC.\n\nInitialize only the alignment padding in the TCP-AO branches, before\nhashing the header.  Use TCPOPT_NOP, as in the normal TCP-AO output path.\nThis avoids adding work to non-AO TCP responses while preserving a valid\nauthenticated header."
          }
        ],
        "id": "CVE-2026-68119",
        "lastModified": "2026-08-17T05:18:11.437",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.5,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.6,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-10T13:19:56.960",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a859b280441fb02f64ed4037f03d5c0c34a7a595"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bbb7db8c74b0b5d17a695136f0f0806ecd0118f6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e1a9d3cc11829c5414a75eb39c704f461936eb24"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fadaff3f66e124c3a62237f9c881819a8ac90309"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:16:29+00:00",
      "cve": "CVE-2026-68119",
      "id": "CVE-2026-68119",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "77",
      "product_status:known_not_affected": "200",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: initialize standalone TCP-AO response padding",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68119.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:42:06Z",
      "cve": "CVE-2026-68119",
      "id": "CVE-2026-68119",
      "initial_release_date": "2026-08-13T16:24:11Z",
      "product_status:known_affected": "29",
      "product_status:known_not_affected": "345",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68119",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68119.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.