A flaw in the Linux kernel caused the verification of TCP MD5 signatures to be performed in a manner that leaked timing information, allowing an attacker to infer the correct MAC by measuring response times. The fix implements a constant‑time comparison to eliminate this side‑channel. The vulnerability is a classic timing side‑channel (CWE‑208) that could be exploited to forge packets or bypass authentication on TCP connections that use MD5 hashing.

The affected vendor is Linux and the product is the Linux kernel. No specific kernel releases are enumerated in the CNA data, so any kernel version compiled before the commit that introduced the constant‑time comparison remains vulnerable.

The CVSS score of 7.0 marks this issue as high severity, and although the EPSS score is unavailable, it is not listed in CISA's KEV catalog. Based on the description, it is inferred that an attacker would deliver crafted TCP packets bearing MD5 signatures and monitor timing differences to recover the correct MAC. Successful exploitation could enable packet forgery or authentication bypass, impacting confidentiality and integrity of network traffic. The attack vector is likely network‑based and does not require privileged local access.