The vulnerability lies in the comparison of Message Authentication Codes in the Linux kernel network stack. The MACs were compared in a non‑constant‑time manner, allowing an attacker to gain information about valid MAC values through timing measurements. The side‑channel attack could enable forging of authenticated packets or leakage of secret data used by TCP‑AO, thereby compromising the integrity of network communication.

All Linux kernel installations that include TCP‑AO support, regardless of distribution, are affected because the issue resides in the generic kernel code. No specific version details are provided beyond the generic kernel reference.

Exploitation requires an attacker to send carefully crafted packets when TCP‑AO is enabled and to perform precise timing analysis of packet processing. No CVSS or EPSS metrics are reported, and the vulnerability is not listed in the CISA KEV catalog, indicating limited publicly available exploitation evidence. However, the side‑channel nature of the flaw means that, with sufficient measurement resources, an adversary could infer MAC values, potentially enabling packet forgery or secret data leakage in environments that rely heavily on TCP‑AO authentication.