CVE-2026-43383: linux Observable Timing Discrepancy
CVSS: 9.4v3.1CriticalModified
AliasesUBUNTU-CVE-2026-43383DEBIAN-CVE-2026-43383
Published 08-05-2026Last modified 19-10-2026
Vulnerability summary
CVE-2026-43383 is a critical (CVSS 9.4) Observable Timing Discrepancy vulnerability in linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.1% of scored vulnerabilities.
CVSS score
9.4/10
010
Critical · v3.1 (CVE.org)EPSS score
0.44%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 35 · Related 50OPENSUSE-SU-2026:21388-1SUSE-SU-2026:22742-1SUSE-SU-2026:22769-1SUSE-SU-2026:22809-1SUSE-SU-2026:22810-1SUSE-SU-2026:22812-1SUSE-SU-2026:22835-1SUSE-SU-2026:22903-1SUSE-SU-2026:22904-1SUSE-SU-2026:3130-1SUSE-SU-2026:3166-1SUSE-SU-2026:3594-1USN-8492-1USN-8492-2USN-8492-3USN-8492-4USN-8492-5USN-8493-1USN-8497-1USN-8498-1USN-8499-1USN-8529-1USN-8530-1USN-8548-1USN-8604-1USN-8605-1USN-8606-1USN-8607-1USN-8609-1USN-8615-1USN-8615-2USN-8616-1USN-8617-1USN-8619-1USN-8635-1USN-8490-1USN-8490-2USN-8491-1USN-8493-2USN-8501-1USN-8508-1USN-8527-1USN-8528-1USN-8529-2USN-8530-2USN-8545-1USN-8546-1USN-8547-1USN-8547-2USN-8548-2
Timeline
- 08-05-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net/tcp-md5: Fix MAC comparison to be constant-time To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.
CVSS metrics
5 scores · 4 sources · 2 versionsMedium 6.3Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Critical 9.4Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:HSourcesAll 4 agree
- OSV · UbuntuEcosystem advisory · calculated9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
- NVDNIST9.4CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
EPSS trend
Probability
0.44%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
0.00 pp
From 0.44% on 19-09-2026
19-09-202619-10-2026
EPSS score0.44%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu157 products
- linux< 3.13.0-214.265 | < 4.4.0-283.317 | < 4.15.0-253.265 | < 5.4.0-233.253 | < 5.15.0-185.195 | < 6.8.0-134.134 | < 6.17.0-40.40
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 4.4.0-1156.162 | < 4.4.0-1194.209 | < 4.15.0-1194.207 | < 5.4.0-1161.172 | < 5.15.0-1111.118 | < 6.8.0-1060.63 | < 6.17.0-1019.19
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < 821c8751fdeecdeecabeb11704dd33439c9e4bbc | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < ff44ec94d4fc8348600a69de0a8fa1102c23bce8 | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < 345a9530756528d7ca407663d659c3c40e75c3dd | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < 5d305a95130a8d08b9545e47f1e18d29d59866cb | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < 02669e2a4d207068edce7e8b5fafd85822018ce6 | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < ae3831b44f477de048287493e184fc3ff913b624 | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < b502e97e29d791ff7a8051f29a414535739be218 | ≥ cfb6eeb4c860592edd123fdea908d23c6ad1c7dc, < 46d0d6f50dab706637f4c18a470aac20a21900d3 | 2.6.20
- linux_kernel≥ 2.6.20, < 5.10.253 | ≥ 5.11, < 6.1.167 | ≥ 6.2, < 6.6.130 | ≥ 6.7, < 6.12.78 | ≥ 6.13, < 6.18.19 | ≥ 6.19, < 6.19.9 | 7.0:rc1 | 7.0:rc2
Debian1 product
- linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.10-1
3 vendors · 160 products
