CVE-2026-80586 - Vulnerability Details

- mptcp: options: reset DSS fields in case of unexpected size

Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: options: reset DSS fields in case of unexpected size

A remote peer could send a malformed DSS with a wrong size, followed by
another DSS or MPC + Data. In this case, the first suboption will be
ignored, but leaving some fields written, which could lead to
inconsistency or access uninitialized data.

Explicitly reset the fields that could have been modified in case of
unexpected size.

Published: 2026-08-26

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A remote peer can send a malformed DSS suboption with an unexpected size to the Linux kernel's Multipath TCP (MPTCP) stack. The kernel ignores the invalid suboption but fails to reset certain internal fields that the malformed data may have touched, leaving them partially initialized or inconsistent. This corrupt state can cause kernel data inconsistencies, a crash, or an uninitialized data read, potentially leading to a denial‑of‑service event.

Affected Systems

The vulnerability affects the MPTCP implementation in the Linux kernel, which is included in all distributions that ship a recent kernel with MPTCP enabled. Any system running an unpatched kernel with MPTCP can be impacted. Specific affected kernel version information is not provided in the CVE data.

Risk and Exploitability

The flaw is exploitable remotely over the network and does not require privileged access. The EPSS score of 0.00404 (below 1%) indicates a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The CVSS score of 9.8 indicates critical severity. An attacker could trigger the inconsistency or crash through carefully crafted packets, posing a high risk to systems with MPTCP enabled.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 15e35fdad7a5576bf3f1c8d688877aeb5d1b506b
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< b1256090816ec46011601e084be580731df58fc7
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 192878df582c51d440bf7b91a15f297f29f2b596
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 26dac5c9ffb20812b475fdf253eb04fab99cff3b
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 4e80eff5c1c893aca2ac1d202f0b256d2e52ecde
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 1fade1b2ac5b1a4948e538fae7313bea57b5ac36
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 27ed642a4e7e4b5df4b8522c72c457a67e052493
`648ef4b88673dadb8463bf0d4b10fbf33d55def8`	affected	< 35772b4981f38ba8059372cde8753e8e477e98ec

Linux

affected

Version	Status	Constraints
`5.6`	affected	—
`0`	unaffected	< 5.6
`5.10.266`	unaffected	≤ 5.10.*
`5.15.217`	unaffected	≤ 5.15.*
`6.1.184`	unaffected	≤ 6.1.*
`6.6.153`	unaffected	≤ 6.6.*
`6.12.105`	unaffected	≤ 6.12.*
`6.18.46`	unaffected	≤ 6.18.*
`7.1.10`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,15e35fdad7a5576bf3f1c8d688877aeb5d1b506b)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,1fade1b2ac5b1a4948e538fae7313bea57b5ac36)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,26dac5c9ffb20812b475fdf253eb04fab99cff3b)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,27ed642a4e7e4b5df4b8522c72c457a67e052493)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,35772b4981f38ba8059372cde8753e8e477e98ec)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,4e80eff5c1c893aca2ac1d202f0b256d2e52ecde)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,b1256090816ec46011601e084be580731df58fc7)`	affected	code_commit	—
`[648ef4b88673dadb8463bf0d4b10fbf33d55def8,192878df582c51d440bf7b91a15f297f29f2b596)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.6`	affected	semver	—
`[0,5.6)`	unaffected	semver	—
`[5.10.266,5.11.0)`	unaffected	semver	—
`[5.15.217,5.16.0)`	unaffected	semver	—
`[6.1.184,6.2.0)`	unaffected	semver	—
`[6.6.153,6.7.0)`	unaffected	semver	—
`[6.12.105,6.13.0)`	unaffected	semver	—
`[6.18.46,6.19.0)`	unaffected	semver	—
`[7.1.10,7.2.0)`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the kernel to a version that includes the MPTCP DSS size validation patch.
If the patch cannot be applied immediately, disable the MPTCP feature on affected hosts to prevent the acceptance of malformed DSS suboptions and mitigate the improper initialization weakness.
Continuously monitor network traffic for unexpected DSS suboptions or patterns that may indicate attempted exploitation, addressing potential evidence of exploitation attempts.

Generated by OpenCVE AI on August 28, 2026 at 14:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00404.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b
https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596
https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36
https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b
https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493
https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec
https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde
https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7
https://lore.kernel.org/linux-cve-announce/2026082616-CVE-2026-80586-008c@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-80586
https://www.cve.org/CVERecord?id=CVE-2026-80586

History

Thu, 27 Aug 2026 18:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-824
References		https://lore.kernel.org/linux-cve-announce/2026082616-CVE-2026-80586-008c@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-80586 https://www.cve.org/CVERecord?id=CVE-2026-80586
Metrics	threat_severity `None`	threat_severity `Important`

Thu, 27 Aug 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Thu, 27 Aug 2026 09:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-665

Thu, 27 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 26 Aug 2026 16:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-665

Wed, 26 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the fields that could have been modified in case of unexpected size.
Title		mptcp: options: reset DSS fields in case of unexpected size
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596 https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36 https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493 https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-26T14:37:41.493Z

Updated: 2026-08-27T05:02:07.204Z

Reserved: 2026-08-26T14:34:25.769Z

Link: CVE-2026-80586

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-26T15:17:14.873

Modified: 2026-08-27T06:17:45.700

Link: CVE-2026-80586

Redhat

Severity : Important

Publid Date: 2026-08-26T00:00:00Z

Links: CVE-2026-80586 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-28T15:00:13Z

Weaknesses

CWE-665
Improper Initialization
CWE-824
Access of Uninitialized Pointer

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object