CVE-2026-68119
CVE CVE-2026-68119EUVD EUVD-2026-55500Published 2026-08-10T11:58:39.000Z
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the option rounded up to a four-byte boundary. tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not four-byte aligned, the one to three bytes after the MAC are left uninitialized and may be transmitted. For the normal TCP-AO hashing mode, those bytes also have to be initialized before computing the MAC. Initialize only the alignment padding in the TCP-AO branches, before hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path. This avoids adding work to non-AO TCP responses while preserving a valid authenticated header.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux decde2586b34b99684faff1eab41e5c496c27fb6 <bbb7db8c74b0b5d17a695136f0f0806ecd0118f6; patch: 0; decde2586b34b99684faff1eab41e5c496c27fb6 <e1a9d3cc11829c5414a75eb39c704f461936eb24; decde2586b34b99684faff1eab41e5c496c27fb6 <fadaff3f66e124c3a62237f9c881819a8ac90309; patch: 7.1.6; patch: 6.18.42; decde2586b34b99684faff1eab41e5c496c27fb6 <a859b280441fb02f64ed4037f03d5c0c34a7a595; 6.7; patch: 6.12.101; patch: 7.2-rc5
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.