CVE-2025-40204

In the Linux kernel, the following vulnerability has been resolved:

sctp: Fix MAC comparison to be constant-time

To prevent timing attacks, MACs need to be compared in constant time. Use the appropriate helper function for this.

SCTP compared MACs with memcmp(), leaking information via timing. A remote adversary could attempt a timing-oracle attack over the network to gradually learn MAC bytes, which is difficult in practice. The fix switches to constant-time crypto_memneq(), removing the side-channel.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.