{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-68119","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-30T09:28:09.369Z","datePublished":"2026-08-10T11:58:39.026Z","dateUpdated":"2026-08-17T04:59:09.650Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-17T04:59:09.650Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: initialize standalone TCP-AO response padding\n\ntcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP\nresponses with TCP-AO options.  The option length carries the actual MAC\nlength, but the TCP header length includes the option rounded up to a\nfour-byte boundary.\n\ntcp_ao_hash_hdr() writes the MAC only.  Thus, when the MAC length is not\nfour-byte aligned, the one to three bytes after the MAC are left\nuninitialized and may be transmitted.  For the normal TCP-AO hashing\nmode, those bytes also have to be initialized before computing the MAC.\n\nInitialize only the alignment padding in the TCP-AO branches, before\nhashing the header.  Use TCPOPT_NOP, as in the normal TCP-AO output path.\nThis avoids adding work to non-AO TCP responses while preserving a valid\nauthenticated header."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","baseScore":7.5,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:N - Remote attackers reach tcp_v4_send_ack() and tcp_v6_send_response() by sending IPv4/IPv6 TCP segments into tcp_v4_rcv()/tcp_v6_rcv() SYN-RECV, TIME-WAIT, and reset paths that build standalone TCP-AO-signed ACK/RST replies transmitted back over the network.\nAC:L - On Internet-facing TCP-AO deployments (BGP/route-server successors to TCP-MD5), an attacker reliably elicits qualifying standalone responses by sending crafted TCP segments; no race, timing lottery, or uncontrollable memory layout is required beyond the peer using a non-4-byte-aligned MAC length.\nPR:N - The uninitialized bytes are returned to the remote packet sender in standalone TCP-AO ACK/RST replies; triggering requires only network reachability to a TCP-AO-enabled listener or an existing TCP-AO TIME-WAIT socket, with no local credentials on the victim host.\nUI:N - No end-user action is needed beyond normal exposure of a TCP-AO-protected network service; the attacker alone sends the triggering TCP segments and captures the padded replies.\nS:U - Kernel stack or skb memory is disclosed to a remote TCP peer within the same host kernel security authority; this is not a VM escape, IOMMU bypass, or other cross-boundary scope change.\nC:H - One to three uninitialized bytes in TCP-AO option alignment padding from the on-stack IPv4 response buffer or IPv6 skb head are transmitted on every qualifying standalone ACK/RST and can be harvested repeatedly to recover kernel stack or skb contents.\nI:N - The bug only fails to initialize alignment padding before transmission; it does not write to or corrupt kernel, socket, or application memory.\nA:N - Standalone TCP-AO responses are still transmitted successfully with no kernel oops, panic, hang, or denial of service; only confidentiality of the leaked padding bytes is affected."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ipv4.c","net/ipv6/tcp_ipv6.c"],"versions":[{"version":"decde2586b34b99684faff1eab41e5c496c27fb6","lessThan":"bbb7db8c74b0b5d17a695136f0f0806ecd0118f6","status":"affected","versionType":"git"},{"version":"decde2586b34b99684faff1eab41e5c496c27fb6","lessThan":"fadaff3f66e124c3a62237f9c881819a8ac90309","status":"affected","versionType":"git"},{"version":"decde2586b34b99684faff1eab41e5c496c27fb6","lessThan":"a859b280441fb02f64ed4037f03d5c0c34a7a595","status":"affected","versionType":"git"},{"version":"decde2586b34b99684faff1eab41e5c496c27fb6","lessThan":"e1a9d3cc11829c5414a75eb39c704f461936eb24","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/tcp_ipv4.c","net/ipv6/tcp_ipv6.c"],"versions":[{"version":"6.7","status":"affected"},{"version":"0","lessThan":"6.7","status":"unaffected","versionType":"semver"},{"version":"6.12.101","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.42","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.6","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.101"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.18.42"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.1.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"7.2"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/bbb7db8c74b0b5d17a695136f0f0806ecd0118f6"},{"url":"https://git.kernel.org/stable/c/fadaff3f66e124c3a62237f9c881819a8ac90309"},{"url":"https://git.kernel.org/stable/c/a859b280441fb02f64ed4037f03d5c0c34a7a595"},{"url":"https://git.kernel.org/stable/c/e1a9d3cc11829c5414a75eb39c704f461936eb24"}],"title":"tcp: initialize standalone TCP-AO response padding","x_generator":{"engine":"bippy-1.2.0"}}}}