CVE-2026-80847
Received Received - Intake

TCP Route Advmss Clamping in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCP_MIN_MSS tcp_select_initial_window() assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAX_ADVMSS is one way to get there, but it is not the only one. The same divide-by-zero can also be reached through the "default advmss" path when RTAX_ADVMSS is left at 0 and the effective advmss is later driven down by route MTU and min_adv_mss. Introduce a tcp_dst_advmss() helper that clamps route advmss to TCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that derive advmss from dst metrics. This keeps the effective MSS from dropping to zero before tcp_select_initial_window() rounds the receive window.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80847
EUVD
EUVD-2026-71297

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the TCP protocol where the advertised maximum segment size (advmss) can become too small, potentially leading to a divide-by-zero error in tcp_select_initial_window(). The issue arises when route-derived advmss values are smaller than the minimum allowed (TCP_MIN_MSS), which can happen through explicit settings or default paths where advmss is reduced by route MTU and min_adv_mss.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to TCP MSS handling. Detection requires checking kernel versions and TCP stack behavior. Examine kernel logs for TCP-related errors or crashes. Use commands like 'uname -a' to check kernel version and 'dmesg | grep -i tcp' to inspect TCP stack issues.

Impact Analysis

This vulnerability could cause system instability or crashes due to divide-by-zero errors in the TCP stack. It may lead to network communication failures, application disruptions, or kernel panics if exploited or triggered by malformed network routes or configurations.

Mitigation Strategies

Apply the latest kernel updates from your Linux distribution to patch the vulnerability. If immediate patching is not possible, consider disabling affected TCP services or applying network-level mitigations like firewall rules to restrict vulnerable traffic.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80847. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart