In the Linux kernel, verification of TCP MD5 signatures used a non‑constant‑time comparison, which could leak information through timing variations. The fix implements a constant‑time comparison to eliminate this side channel. The vulnerability is a timing side‑channel (CWE‑208). Based on the description, it is inferred that an attacker who observes timing differences could potentially deduce the correct MAC and, with sufficient information, forge packets or bypass authentication on TCP connections that rely on MD5 hashing.

The affected vendor is Linux and the product is the Linux kernel. The kernel source is enumerated by the CNA as the entire Linux kernel; the CPE entries specify that Linux kernel 7.0 rc1 and 7.0 rc2 are explicitly affected, so any kernel version compiled before the commit that introduced the constant‑time comparison remains vulnerable.

The CVSS score of 9.4 marks this issue as high severity, and the EPSS score of < 1% indicates a very low but nonzero exploitation probability. It is not listed in CISA's KEV catalog. The likely attack vector is network‑based and does not require privileged local access. Based on the description, it is inferred that an attacker would deliver crafted TCP packets bearing MD5 signatures and monitor timing differences to recover the correct MAC. Successful exploitation could enable packet forgery or authentication bypass, impacting confidentiality and integrity of network traffic.