CVE-2026-80585 (GCVE-0-2026-80585)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 05:02
VLAI
Title
mptcp: fastopen: only mark MPTFO subflows with SYN data
Summary
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established(). Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty. Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < f75f174edc865738522e514d042cf5627f084859 (git)
Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < fca7e444c04689fe4cc6b56f2725f804a4bb1ef9 (git)
Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < 75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5 (git)
Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < 72b4a0c51a4b550d40301d60a366b429b8c8e78d (git)
Affected: 36b122baf6a8bd46b4a591f12f4ed17b22257408 , < e00b63056fb4f261455b3e5df5268a1f8ce47a87 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.2
Unaffected: 0 , < 6.2 (semver)
Unaffected: 6.6.153 , ≤ 6.6.* (semver)
Unaffected: 6.12.105 , ≤ 6.12.* (semver)
Unaffected: 6.18.46 , ≤ 6.18.* (semver)
Unaffected: 7.1.10 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f75f174edc865738522e514d042cf5627f084859",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "fca7e444c04689fe4cc6b56f2725f804a4bb1ef9",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "72b4a0c51a4b550d40301d60a366b429b8c8e78d",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            },
            {
              "lessThan": "e00b63056fb4f261455b3e5df5268a1f8ce47a87",
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "lessThan": "6.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fastopen: only mark MPTFO subflows with SYN data\n\nPassive TCP Fast Open accepts a valid-cookie SYN even when it carries\nno data. In that case the child socket\u0027s receive queue is intentionally\nleft empty.\n\nmptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking\nfor queued SYN data. That made data-less TFO SYNs hit a WARN and, if\nthe warning was non-fatal, left stale MPTFO state behind. The stale\nflag could later trigger a state-confusion bug in\ncheck_fully_established().\n\nOnly mark the subflow as MPTFO after confirming that an SKB was queued.\nReturn quietly when the receive queue is empty.\n\nNote that mptcp_subflow_context\u0027s is_mptfo field is now not just about\nsubflows where the TFO was present, but about MPTFO subflow that\nconsumed SYN data. Only having a valid cookie but not carrying data is\nnot really \"doing TFO\"."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is reached by sending crafted TCP/MPTCP segments to a listening socket over the network (ip4/ip6 receive -\u003e tcp_conn_request/tcp_rcv_state_process -\u003e subflow_prep_synack or mptcp_incoming_options -\u003e check_fully_established); per kernel CNA guidance, net stack packet-handling paths are Network.\nAC:L - In the intended passive-MPTFO deployment (MPTCP listener with net.ipv4.tcp_fastopen server bit set), the attacker controls obtaining a valid TFO cookie and then sending a data-less SYN followed by an out-of-order MPC_ACK to deterministically hit the stale is_mptfo path in check_fully_established().\nPR:N - Exploitation requires only unauthenticated inbound TCP connections to an MPTCP listener; the attacker obtains the TFO cookie from their own prior connection and needs no local account, capability, or namespace privileges on the target host.\nUI:N - No victim interaction is required beyond the server normally accepting TCP connections; the attacker programmatically sends the SYN and follow-up MPC_ACK packets without anyone opening files, clicking links, or performing other actions.\nS:U - Impact is confined to kernel MPTCP/TCP connection state on the target host and does not cross VM, container, IOMMU, or other security boundaries; it is not a sandbox or guest-to-host escape.\nC:L - Premature fully_established with attacker-chosen MPTCP keys desynchronizes handshake and DSS/map state, enabling misdelivery or premature exposure of connection-level data/metadata to the remote peer before normal MP_CAPABLE validation completes.\nI:H - Stale is_mptfo lets an out-of-order MPC_ACK force __mptcp_subflow_fully_established(), writing attacker-controlled sndr_key/ack_seq into msk and subflow crypto state and corrupting subsequent DSS/ACK handling on the server multipath socket.\nA:H - Data-less passive-TFO SYNs hit WARN_ON_ONCE(!skb) on every trigger, and the resulting inconsistent is_mptfo/fully_established state can cause repeatable kernel WARN/oops (panic_on_warn panic) plus connection reset storms against internet-facing MPTCP servers."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T05:02:06.112Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859"
        },
        {
          "url": "https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9"
        },
        {
          "url": "https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5"
        },
        {
          "url": "https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d"
        },
        {
          "url": "https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87"
        }
      ],
      "title": "mptcp: fastopen: only mark MPTFO subflows with SYN data",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80585",
    "datePublished": "2026-08-26T14:37:40.901Z",
    "dateReserved": "2026-08-26T14:34:25.769Z",
    "dateUpdated": "2026-08-27T05:02:06.112Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80585",
      "date": "2026-09-21",
      "epss": "0.00317",
      "percentile": "0.2476"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-27T01:09:17.000Z",
      "cve": "CVE-2026-80585",
      "id": "msrc_CVE-2026-80585",
      "initial_release_date": "2026-08-27T01:09:17.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "mptcp: fastopen: only mark MPTFO subflows with SYN data",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80585.json",
      "version": "1"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/fastopen.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "f75f174edc865738522e514d042cf5627f084859",
                    "status": "affected",
                    "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fca7e444c04689fe4cc6b56f2725f804a4bb1ef9",
                    "status": "affected",
                    "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5",
                    "status": "affected",
                    "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "72b4a0c51a4b550d40301d60a366b429b8c8e78d",
                    "status": "affected",
                    "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e00b63056fb4f261455b3e5df5268a1f8ce47a87",
                    "status": "affected",
                    "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/mptcp/fastopen.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.2"
                  },
                  {
                    "lessThan": "6.2",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.153",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.105",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.46",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.10",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fastopen: only mark MPTFO subflows with SYN data\n\nPassive TCP Fast Open accepts a valid-cookie SYN even when it carries\nno data. In that case the child socket\u0027s receive queue is intentionally\nleft empty.\n\nmptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking\nfor queued SYN data. That made data-less TFO SYNs hit a WARN and, if\nthe warning was non-fatal, left stale MPTFO state behind. The stale\nflag could later trigger a state-confusion bug in\ncheck_fully_established().\n\nOnly mark the subflow as MPTFO after confirming that an SKB was queued.\nReturn quietly when the receive queue is empty.\n\nNote that mptcp_subflow_context\u0027s is_mptfo field is now not just about\nsubflows where the TFO was present, but about MPTFO subflow that\nconsumed SYN data. Only having a valid cookie but not carrying data is\nnot really \"doing TFO\"."
          }
        ],
        "id": "CVE-2026-80585",
        "lastModified": "2026-08-27T06:17:45.397",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.4,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-26T15:17:14.750",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T07:00:21+00:00",
      "cve": "CVE-2026-80585",
      "id": "CVE-2026-80585",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: fastopen: only mark MPTFO subflows with SYN data",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80585.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:11:11Z",
      "cve": "CVE-2026-80585",
      "id": "CVE-2026-80585",
      "initial_release_date": "2026-08-27T00:11:26Z",
      "product_status:known_affected": "114",
      "product_status:known_not_affected": "239",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80585",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80585.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.