What is the CVSS score of CVE-2026-68119?

CVE-2026-68119 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-68119?

CVE-2026-68119 is a kernel memory disclosure affecting Linux systems running kernel v6.7 or later with TCP Authentication Option (TCP-AO) enabled, with no public exploit identified at time of…

How to fix or mitigate CVE-2026-68119?

Within 24 hours, identify and inventory Linux systems running kernel v6.7 or later with TCP-AO feature enabled, prioritizing production systems with external network exposure. Within 7 days, disable TCP-AO if operationally unnecessary and review network controls to limit on-path observer access to affected systems; document current kernel versions and patch timelines. Within 30 days, continue monitoring Linux vendor security advisories for patch availability and establish a deployment plan to apply fixes to remaining TCP-AO-enabled systems; prioritize systems in high-exposure environments (publicly routable, cross-datacenter links).

Linux Kernel CVE-2026-68119

EUVD-2026-55500 HIGH

2026-08-10 Linux

GHSA-5h3v-9fcc-4vc7

Information Disclosure Linux

7.5

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

3.7 LOW

AC:H because TCP-AO is non-default and requires explicit configuration; C:L because disclosure is bounded to 1-3 uninitialized padding bytes, not broad memory.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 14, 2026 - 02:21 vuln.today

CVSS changed

Aug 13, 2026 - 23:37 NVD

7.5 (HIGH)

CVE Published

Aug 10, 2026 - 11:58 cve.org

HIGH 7.5

CVE Published

Aug 10, 2026 - 11:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

tcp: initialize standalone TCP-AO response padding

tcp_v4_send_ack() and tcp_v6_send_response() construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the option rounded up to a four-byte boundary.

tcp_ao_hash_hdr() writes the MAC only. Thus, when the MAC length is not four-byte aligned, the one to three bytes after the MAC are left uninitialized and may be transmitted. For the normal TCP-AO hashing mode, those bytes also have to be initialized before computing the MAC.

Initialize only the alignment padding in the TCP-AO branches, before hashing the header. Use TCPOPT_NOP, as in the normal TCP-AO output path. This avoids adding work to non-AO TCP responses while preserving a valid authenticated header.

AnalysisAI

Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.

Technical ContextAI

TCP-AO (TCP Authentication Option, RFC 5925) provides cryptographic authentication for TCP sessions and was introduced in the Linux kernel around v6.7. The functions tcp_v4_send_ack() and tcp_v6_send_response() build standalone TCP responses that embed TCP-AO options. The option header carries the actual MAC length, but the TCP header length field is rounded up to a four-byte boundary. The kernel's tcp_ao_hash_hdr() writes only the MAC bytes themselves, leaving the one to three alignment padding bytes between the MAC and the next boundary uninitialized. These bytes - which may reside in kernel stack or heap memory - are then transmitted to the remote peer, constituting an information-disclosure side-channel. The root cause is an uninitialized-memory use pattern (analogous to CWE-908), not listed as a CWE in the provided data.

RemediationAI

Upgrade to a patched Linux kernel release: v6.12.101, v6.18.42, or v7.1.6 for stable-branch users, or v7.2-rc5 for mainline tracking. Patch commits are available at https://git.kernel.org/stable/c/bbb7db8c74b0b5d17a695136f0f0806ecd0118f6 (6.12 branch), https://git.kernel.org/stable/c/fadaff3f66e124c3a62237f9c881819a8ac90309 (6.18 branch), https://git.kernel.org/stable/c/a859b280441fb02f64ed4037f03d5c0c34a7a595 (7.1 branch), and https://git.kernel.org/stable/c/e1a9d3cc11829c5414a75eb39c704f461936eb24 (mainline). If patching immediately is not feasible, disabling TCP-AO on all sockets eliminates exposure entirely with no functional impact unless TCP-AO authentication is operationally required. TCP-AO configuration is performed via socket options or routing policy; consult the kernel tcp_ao documentation for teardown steps.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

CVE-2026-68119 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-68119

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code