CVE-2026-43383

What it actually does

This vulnerability is a cryptographic timing weakness in the Linux kernel TCP MD5 signature handling code. When validating TCP MD5 message authentication codes, the kernel used a comparison method that could return faster or slower depending on how much of the supplied MAC matched the expected value. A remote, unauthenticated attacker able to send TCP packets to a service using TCP MD5 signatures could potentially measure response timing differences to infer valid authentication material or forge accepted packets. The most exposed use case is TCP MD5 protection for routing protocols such as BGP, where successful exploitation could allow packet injection, session disruption, route manipulation, or denial of service against authenticated TCP sessions.

Why it matters to the business

Systems that rely on TCP MD5 signatures for trust between network peers may not receive the protection expected from that control. In practical terms, exploitation could disrupt critical network connectivity, interfere with routing stability, or allow unauthorized manipulation of protected TCP sessions. Although the EPSS score is currently low and there is no known CISA KEV listing or public exploit maturity reported, the CVSS severity is high because successful exploitation can affect integrity and availability of network services. Organizations operating Linux-based routers, route reflectors, firewalls, load balancers, appliances, or servers participating in TCP MD5-protected sessions should treat remediation as important, especially where routing infrastructure is internet-facing or reachable from untrusted networks.

How an attack unfolds

An attacker first identifies a Linux system accepting TCP connections that use the TCP MD5 signature option, commonly seen in routing protocol deployments. The attacker then sends repeated packets with intentionally varied MD5 signature values and measures subtle timing differences in how the target rejects invalid signatures. Because the vulnerable comparison is not constant-time, those timing differences may reveal whether portions of the supplied MAC match the expected value. By iterating this process over many attempts, the attacker may be able to derive enough information to craft packets that pass TCP MD5 validation. Once accepted, forged packets could be used to interfere with an existing TCP session, inject unauthorized data, reset sessions, destabilize routing relationships, or cause denial of service. Exploitation is likely to require precise measurement and repeated packet delivery, but it does not require authentication, local access, or user interaction.

How to fix it

Apply the Linux kernel update from the relevant operating system, appliance, or distribution vendor that changes TCP MD5 MAC comparison to a constant-time helper. No universal fixed kernel version was provided in the input, so remediation should be based on vendor advisories and package changelogs for the deployed distribution or appliance. Reboot into the patched kernel or apply an approved live patch where supported, then verify that the running kernel is the corrected version. As compensating controls, restrict access to TCP MD5-protected services to trusted peer IP addresses, enforce infrastructure ACLs, use BGP TTL security/GTSM where applicable, monitor and rate-limit unexpected connection attempts, and prefer stronger modern protections such as TCP-AO, IPsec, or authenticated encrypted tunnels where operationally feasible. After patching, consider rotating shared TCP MD5 keys for high-value peers if there is concern that timing attacks may have been attempted over an extended period.

How to confirm the fix worked

Confirm that all affected Linux kernels have been updated to a vendor-fixed build and that systems are actually running the patched kernel after reboot or live-patch activation. Validate using the distribution package manager, kernel version, and vendor changelog rather than relying only on installed package presence. Where source verification is possible, confirm that TCP MD5 MAC comparison uses a constant-time comparison helper such as crypto_memneq or an equivalent constant-time routine instead of a byte-by-byte early-exit comparison. Review network devices, Linux routers, container hosts, and appliances that participate in TCP MD5-protected sessions. Confirm that routing adjacencies and other protected sessions remain stable after remediation, and verify that access controls limit TCP MD5-protected endpoints to expected peer addresses only.

Typical attack path

1. Identify Linux systems or network appliances using TCP MD5 signatures on reachable TCP services, especially routing protocols such as BGP.
2. Send large numbers of TCP packets with crafted or partially guessed MD5 signature values.
3. Measure response timing differences associated with failed MAC validation.
4. Use timing observations to iteratively infer valid MAC comparison characteristics.
5. Craft TCP packets that are more likely to pass MD5 signature validation.
6. Inject, disrupt, or reset protected TCP sessions, potentially affecting routing integrity or service availability.

How to detect it

There is no reliable single log entry or file artifact that proves exploitation of this timing side-channel, because attacks may look like repeated invalid TCP MD5-protected packets and failed session attempts. Detection should focus on evidence of abnormal probing and downstream effects. Review routing daemon logs, kernel logs, firewall logs, NetFlow/IPFIX, packet captures, and IDS telemetry for repeated TCP packets carrying MD5 signature options from unexpected sources, bursts of authentication failures, unusual BGP or routing session resets, unexplained route flaps, and high-volume rejected traffic to TCP MD5-protected ports. For BGP environments, correlate peer reset timestamps with firewall denies, packet captures, and routing daemon messages indicating authentication or MD5 failures. Investigate any sustained attempts from non-peer IP addresses to reach protected TCP services. Because successful exploitation may result in accepted forged packets rather than obvious errors, also examine route changes, unexpected UPDATE activity, session resets, and control-plane instability around suspicious probing windows.

What your security team should do

• Prioritize patching Linux systems that use TCP MD5 signatures for routing, network infrastructure, or other high-availability TCP services.
• Inventory systems using TCP MD5, including Linux-based routers, route reflectors, appliances, and servers with BGP or similar peerings.
• Apply vendor kernel updates and reboot or live-patch to ensure the fixed code is active.
• Restrict network access to TCP MD5-protected services so only expected peers can send packets to them.
• Review routing-protocol logs for unexplained session resets, authentication failures, route flaps, or bursts of rejected packets.
• Consider rotating TCP MD5 shared secrets for critical peers after patching, especially if suspicious probing was observed.
• Evaluate migration from TCP MD5 to stronger alternatives such as TCP-AO, IPsec, or encrypted authenticated tunnels where supported.
• Track vendor advisories despite the current low EPSS score and lack of KEV listing, because the technical impact is high for exposed network infrastructure.