CVE-2026-68119

A flaw was found in the Linux kernel's TCP Authentication Option (TCP-AO) implementation. When the kernel constructs standalone TCP responses with TCP-AO options, padding bytes in the TCP header may be left uninitialized. If the Message Authentication Code (MAC) length is not four-byte aligned, these uninitialized bytes could be transmitted. This can lead to the disclosure of sensitive information to a remote attacker.

This issue affects TCP Authentication Option (TCP-AO). Standalone ACK/response construction leaves TCP-AO padding uninitialized. Systems not using TCP-AO are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.