CVE-2026-80585
Received Received - Intake

TCP Fast Open State Confusion in Linux Kernel

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established(). Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty. Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-80585
EUVD
EUVD-2026-66500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the Multipath TCP (MPTCP) Fast Open feature. When a passive TCP Fast Open accepts a SYN packet without data, it incorrectly marks the subflow as MPTFO before checking for queued SYN data. This leads to a warning and potential stale state, causing confusion in later operations.

Detection Guidance

This vulnerability is specific to the Linux kernel's MPTCP (Multipath TCP) implementation and may not have direct network detection commands. Check kernel logs for warnings related to MPTCP or TCP Fast Open using: dmesg | grep -i mptcp or dmesg | grep -i fastopen. Verify kernel version with uname -r and compare against patched versions.

Impact Analysis

The vulnerability could cause system instability or crashes due to the stale MPTFO state triggering bugs in socket state management. It may also lead to unexpected behavior in network connections using MPTCP Fast Open.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-80585. If immediate patching is not possible, disable MPTCP or TCP Fast Open temporarily by setting sysctl parameters: sysctl -w net.mptcp.enabled=0 and sysctl -w net.ipv4.tcp_fastopen=0. Monitor system logs for related errors after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80585. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart