CVE-2026-23364 — Observable Timing Discrepancy in Linux
Severity
7.4HIGHNVD
EPSS
0.0%
top 85.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Compare MACs in constant time
To prevent timing attacks, MAC comparisons need to be constant-time.
Replace the memcmp() with the correct function, crypto_memneq().
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2
Affected Packages5 packages
▶CVEListV5linux/linuxe2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 — cd52a0e309659537048a864211abc3ea4c5caa63+6
🔴Vulnerability Details
3OSV▶
CVE-2026-23364: In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons ne↗2026-03-25
GHSA▶
GHSA-4mmg-5v66-42gx: In the Linux kernel, the following vulnerability has been resolved:
ksmbd: Compare MACs in constant time
To prevent timing attacks, MAC comparisons↗2026-03-25