Vulnerability-Lookup

CVE-2026-80587 (GCVE-0-2026-80587)

Vulnerability from cvelistv5 – Published: 2026-08-26 14:37 – Updated: 2026-08-27 12:40

Title

mptcp: avoid combining some incoming suboptions

Summary

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes. The new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this option [1], which is not the case on Linux. Here are the rules: Which options can be used together? X: mutually exclusive O: often used together C: can be used together in some cases P: could be used together but we prefer not to (optimisations) | Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC | |------|------|------|------|------|------|------|------|------| | MPC |------|------|------|------|------|------|------|------| | MPJ | X |------|------|------|------|------|------|------| | DSS | X | X |------|------|------|------|------|------| | ADD | X | X | P |------|------|------|------|------| | RM | C | C | C | P |------|------|------|------| | PRIO | X | C | C | C | C |------|------|------| | FAIL | X | X | C | X | X | X |------|------| | FC | X | X | P | X | X | X | X |------| | RST | X | X | X | X | X | X | O | O | |------|------|------|------|------|------|------|------|------| The only difference is with the 'P': another stack could send and ADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be allowed. A few points of attention: - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is no reason to add it with a SYN. Note that even with a 4th ACK, it doesn't seem to be useful, except when IDs are known in advance via another channel. Better not to break that. - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer result to a reject of the two options, but only the second suboption is ignored. That seems OK to do that for this unexpected error. At least now all inconsistent combinations are handled the same way. This could change later in next. This also means the explicit checks for having both MPC + MPJ in subflow.c will now be unreachable. That's fine, they will be removed in a follow-up patch. - In case of conflicting combinations, the extra suboption(s) is/are ignored: having such combinations either means the remote peer is buggy, or is evil. The simplest action is then taken in this case: stop processing the current suboption. - In mp_opt->suboptions, there is also a bit reserved to the checksum, which can be used in an MP_CAPABLE and a DSS. Each time a DSS option can be used in parallel with another option, the checksum can be set, so the verification is combined into a new OPTIONS_MPTCP_DSS macro. - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional Checksum: they are the same as the ones found in a DSS, because a DSS cannot be used in parallel to an MP_CAPABLE. Similarly, even if there is room, a DSS cannot be used with an MP_JOIN.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

6 references

URL	Tags
https://git.kernel.org/stable/c/0e2210af439755a2a…
https://git.kernel.org/stable/c/dc1d8d3eb345c616f…
https://git.kernel.org/stable/c/099bfcbd0c16ae9b5…
https://git.kernel.org/stable/c/a04dcc784959e4702…
https://git.kernel.org/stable/c/6bab907292155513a…
https://git.kernel.org/stable/c/b6ee361524641f57b…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < 0e2210af439755a2af352eea4178261dcf61742e (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < dc1d8d3eb345c616fbe922a010fa391c72c54d52 (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < 099bfcbd0c16ae9b50aba2a1bea033e63f895da7 (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < a04dcc784959e4702048785d87e0d029bd2fbdcb (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < 6bab907292155513af397a12ccb488acbfc30d79 (git) Affected: eda7acddf8080bb2d022a8d4b8b2345eb80c63ec , < b6ee361524641f57b2e2363f7737f20e17f67827 (git)	guessed
Linux	Linux	Affected: 5.6 Unaffected: 0 , < 5.6 (semver) Unaffected: 5.15.218 , ≤ 5.15.* (semver) Unaffected: 6.6.153 , ≤ 6.6.* (semver) Unaffected: 6.12.105 , ≤ 6.12.* (semver) Unaffected: 6.18.46 , ≤ 6.18.* (semver) Unaffected: 7.1.10 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/options.c",
            "net/mptcp/protocol.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e2210af439755a2af352eea4178261dcf61742e",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "dc1d8d3eb345c616fbe922a010fa391c72c54d52",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "099bfcbd0c16ae9b50aba2a1bea033e63f895da7",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "a04dcc784959e4702048785d87e0d029bd2fbdcb",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "6bab907292155513af397a12ccb488acbfc30d79",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "b6ee361524641f57b2e2363f7737f20e17f67827",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/options.c",
            "net/mptcp/protocol.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.218",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.153",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.105",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.46",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.10",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid combining some incoming suboptions\n\nSome MPTCP suboptions are mutually exclusive according to the RFC8684,\nbut also because in different places, the code doesn\u0027t expect some\ncombinations to be present. That\u0027s specially true for suboptions that\nwould be present twice, but with different attributes.\n\nThe new restrictions are the same as the ones applied on the output\nside, with mptcp_write_options. The same rules can be reused with a\nsmall fix: an MP_FASTCLOSE can be used with a DSS when the sender picks\nthis option [1], which is not the case on Linux. Here are the rules:\n\n  Which options can be used together?\n\n  X: mutually exclusive\n  O: often used together\n  C: can be used together in some cases\n  P: could be used together but we prefer not to (optimisations)\n\n  | Opt: | MPC  | MPJ  | DSS  | ADD  |  RM  | PRIO | FAIL |  FC  |\n  |------|------|------|------|------|------|------|------|------|\n  | MPC  |------|------|------|------|------|------|------|------|\n  | MPJ  |  X   |------|------|------|------|------|------|------|\n  | DSS  |  X   |  X   |------|------|------|------|------|------|\n  | ADD  |  X   |  X   |  P   |------|------|------|------|------|\n  | RM   |  C   |  C   |  C   |  P   |------|------|------|------|\n  | PRIO |  X   |  C   |  C   |  C   |  C   |------|------|------|\n  | FAIL |  X   |  X   |  C   |  X   |  X   |  X   |------|------|\n  | FC   |  X   |  X   |  P   |  X   |  X   |  X   |  X   |------|\n  | RST  |  X   |  X   |  X   |  X   |  X   |  X   |  O   |  O   |\n  |------|------|------|------|------|------|------|------|------|\n\nThe only difference is with the \u0027P\u0027: another stack could send and\nADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be\nallowed.\n\nA few points of attention:\n\n - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is\n   no reason to add it with a SYN. Note that even with a 4th ACK, it\n   doesn\u0027t seem to be useful, except when IDs are known in advance via\n   another channel. Better not to break that.\n\n - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer\n   result to a reject of the two options, but only the second suboption\n   is ignored. That seems OK to do that for this unexpected error. At\n   least now all inconsistent combinations are handled the same way.\n   This could change later in next. This also means the explicit checks\n   for having both MPC + MPJ in subflow.c will now be unreachable.\n   That\u0027s fine, they will be removed in a follow-up patch.\n\n - In case of conflicting combinations, the extra suboption(s) is/are\n   ignored: having such combinations either means the remote peer is\n   buggy, or is evil. The simplest action is then taken in this case:\n   stop processing the current suboption.\n\n - In mp_opt-\u003esuboptions, there is also a bit reserved to the checksum,\n   which can be used in an MP_CAPABLE and a DSS. Each time a DSS option\n   can be used in parallel with another option, the checksum can be set,\n   so the verification is combined into a new OPTIONS_MPTCP_DSS macro.\n\n - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional\n   Checksum: they are the same as the ones found in a DSS, because a DSS\n   cannot be used in parallel to an MP_CAPABLE. Similarly, even if there\n   is room, a DSS cannot be used with an MP_JOIN."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in incoming MPTCP TCP option parsing reached from tcp_v4_rcv/tcp_rcv_established via tcp_data_queue and mptcp_incoming_options, so any remote TCP peer can trigger it with crafted MPTCP suboptions on internet-facing servers, cloud hosts, or mobile MPTCP endpoints.\nAC:L - The attacker controls all TCP/MPTCP option bytes and can deterministically pack mutually exclusive suboptions (e.g., MP_CAPABLE+data with DSS, or DSS with MP_JOIN) into one header to leave stale flags like mpc_map while overwriting mapping/ack fields; no uncontrollable races or rare victim state are required.\nPR:N - Exploitation requires only the ability to be the remote endpoint of a TCP/MPTCP connection to a listening service or to a client that negotiated MPTCP; no local account, capabilities, namespaces, or application authentication on the victim is needed.\nUI:N - Malformed combined suboptions are parsed automatically in RX softirq on every qualifying segment after handshake; no victim mount, click, or other deliberate action is required beyond normal network reachability.\nS:U - Impact stays within kernel networking and MPTCP socket state on the affected host and does not cross VM, container, sandbox, or IOMMU security boundaries.\nC:H - Conflicting suboptions produce inconsistent DSS/MPC state (e.g., mpc_map retained while DSS fields overwrite data_seq/ack), and attacker-controlled data_ack values feed ack_update_msk, enabling mis-delivered data exposure and stale-field reads analogous to prior MPTCP parser CVEs.\nI:H - Inconsistent parsed options drive ack_update_msk, DSS mapping, and path-manager actions (ADD_ADDR, MP_FAIL, MP_PRIO, FASTCLOSE) with attacker-controlled sequence, key, and address fields, corrupting MPTCP connection state and the reassembled application byte stream.\nA:H - Invalid mappings and conflicting suboptions cause subflow resets, connection fallback/teardown, and repeatable remote DoS; corrupted MPTCP state can also hit WARN/panic paths during mapping validation and cleanup on MPTCP-enabled kernels."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-27T12:40:23.299Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0e2210af439755a2af352eea4178261dcf61742e"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52"
        },
        {
          "url": "https://git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7"
        },
        {
          "url": "https://git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827"
        }
      ],
      "title": "mptcp: avoid combining some incoming suboptions",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80587",
    "datePublished": "2026-08-26T14:37:42.093Z",
    "dateReserved": "2026-08-26T14:34:25.769Z",
    "dateUpdated": "2026-08-27T12:40:23.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80587",
      "date": "2026-08-27",
      "epss": "0.00364",
      "percentile": "0.29171"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80587\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-26T15:17:15.017\",\"lastModified\":\"2026-08-27T13:18:41.093\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nmptcp: avoid combining some incoming suboptions\\n\\nSome MPTCP suboptions are mutually exclusive according to the RFC8684,\\nbut also because in different places, the code doesn\u0027t expect some\\ncombinations to be present. That\u0027s specially true for suboptions that\\nwould be present twice, but with different attributes.\\n\\nThe new restrictions are the same as the ones applied on the output\\nside, with mptcp_write_options. The same rules can be reused with a\\nsmall fix: an MP_FASTCLOSE can be used with a DSS when the sender picks\\nthis option [1], which is not the case on Linux. Here are the rules:\\n\\n  Which options can be used together?\\n\\n  X: mutually exclusive\\n  O: often used together\\n  C: can be used together in some cases\\n  P: could be used together but we prefer not to (optimisations)\\n\\n  | Opt: | MPC  | MPJ  | DSS  | ADD  |  RM  | PRIO | FAIL |  FC  |\\n  |------|------|------|------|------|------|------|------|------|\\n  | MPC  |------|------|------|------|------|------|------|------|\\n  | MPJ  |  X   |------|------|------|------|------|------|------|\\n  | DSS  |  X   |  X   |------|------|------|------|------|------|\\n  | ADD  |  X   |  X   |  P   |------|------|------|------|------|\\n  | RM   |  C   |  C   |  C   |  P   |------|------|------|------|\\n  | PRIO |  X   |  C   |  C   |  C   |  C   |------|------|------|\\n  | FAIL |  X   |  X   |  C   |  X   |  X   |  X   |------|------|\\n  | FC   |  X   |  X   |  P   |  X   |  X   |  X   |  X   |------|\\n  | RST  |  X   |  X   |  X   |  X   |  X   |  X   |  O   |  O   |\\n  |------|------|------|------|------|------|------|------|------|\\n\\nThe only difference is with the \u0027P\u0027: another stack could send and\\nADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be\\nallowed.\\n\\nA few points of attention:\\n\\n - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is\\n   no reason to add it with a SYN. Note that even with a 4th ACK, it\\n   doesn\u0027t seem to be useful, except when IDs are known in advance via\\n   another channel. Better not to break that.\\n\\n - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer\\n   result to a reject of the two options, but only the second suboption\\n   is ignored. That seems OK to do that for this unexpected error. At\\n   least now all inconsistent combinations are handled the same way.\\n   This could change later in next. This also means the explicit checks\\n   for having both MPC + MPJ in subflow.c will now be unreachable.\\n   That\u0027s fine, they will be removed in a follow-up patch.\\n\\n - In case of conflicting combinations, the extra suboption(s) is/are\\n   ignored: having such combinations either means the remote peer is\\n   buggy, or is evil. The simplest action is then taken in this case:\\n   stop processing the current suboption.\\n\\n - In mp_opt-\u003esuboptions, there is also a bit reserved to the checksum,\\n   which can be used in an MP_CAPABLE and a DSS. Each time a DSS option\\n   can be used in parallel with another option, the checksum can be set,\\n   so the verification is combined into a new OPTIONS_MPTCP_DSS macro.\\n\\n - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional\\n   Checksum: they are the same as the ones found in a DSS, because a DSS\\n   cannot be used in parallel to an MP_CAPABLE. Similarly, even if there\\n   is room, a DSS cannot be used with an MP_JOIN.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/mptcp/options.c\",\"net/mptcp/protocol.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"eda7acddf8080bb2d022a8d4b8b2345eb80c63ec\",\"lessThan\":\"0e2210af439755a2af352eea4178261dcf61742e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eda7acddf8080bb2d022a8d4b8b2345eb80c63ec\",\"lessThan\":\"dc1d8d3eb345c616fbe922a010fa391c72c54d52\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eda7acddf8080bb2d022a8d4b8b2345eb80c63ec\",\"lessThan\":\"099bfcbd0c16ae9b50aba2a1bea033e63f895da7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eda7acddf8080bb2d022a8d4b8b2345eb80c63ec\",\"lessThan\":\"a04dcc784959e4702048785d87e0d029bd2fbdcb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eda7acddf8080bb2d022a8d4b8b2345eb80c63ec\",\"lessThan\":\"6bab907292155513af397a12ccb488acbfc30d79\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"eda7acddf8080bb2d022a8d4b8b2345eb80c63ec\",\"lessThan\":\"b6ee361524641f57b2e2363f7737f20e17f67827\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/mptcp/options.c\",\"net/mptcp/protocol.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.218\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.153\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.105\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.46\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.10\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0e2210af439755a2af352eea4178261dcf61742e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-27T13:38:55+00:00",
      "cve": "CVE-2026-80587",
      "id": "CVE-2026-80587",
      "initial_release_date": "2026-08-26T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mptcp: avoid combining some incoming suboptions",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80587.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-80587

Vulnerability from fkie_nvd - Published: 2026-08-26 15:17 - Updated: 2026-08-27 13:18

Severity

9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0e2210af439755a2af352eea4178261dcf61742e
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/options.c",
            "net/mptcp/protocol.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0e2210af439755a2af352eea4178261dcf61742e",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "dc1d8d3eb345c616fbe922a010fa391c72c54d52",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "099bfcbd0c16ae9b50aba2a1bea033e63f895da7",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "a04dcc784959e4702048785d87e0d029bd2fbdcb",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "6bab907292155513af397a12ccb488acbfc30d79",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            },
            {
              "lessThan": "b6ee361524641f57b2e2363f7737f20e17f67827",
              "status": "affected",
              "version": "eda7acddf8080bb2d022a8d4b8b2345eb80c63ec",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/mptcp/options.c",
            "net/mptcp/protocol.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.218",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid combining some incoming suboptions\n\nSome MPTCP suboptions are mutually exclusive according to the RFC8684,\nbut also because in different places, the code doesn\u0027t expect some\ncombinations to be present. That\u0027s specially true for suboptions that\nwould be present twice, but with different attributes.\n\nThe new restrictions are the same as the ones applied on the output\nside, with mptcp_write_options. The same rules can be reused with a\nsmall fix: an MP_FASTCLOSE can be used with a DSS when the sender picks\nthis option [1], which is not the case on Linux. Here are the rules:\n\n  Which options can be used together?\n\n  X: mutually exclusive\n  O: often used together\n  C: can be used together in some cases\n  P: could be used together but we prefer not to (optimisations)\n\n  | Opt: | MPC  | MPJ  | DSS  | ADD  |  RM  | PRIO | FAIL |  FC  |\n  |------|------|------|------|------|------|------|------|------|\n  | MPC  |------|------|------|------|------|------|------|------|\n  | MPJ  |  X   |------|------|------|------|------|------|------|\n  | DSS  |  X   |  X   |------|------|------|------|------|------|\n  | ADD  |  X   |  X   |  P   |------|------|------|------|------|\n  | RM   |  C   |  C   |  C   |  P   |------|------|------|------|\n  | PRIO |  X   |  C   |  C   |  C   |  C   |------|------|------|\n  | FAIL |  X   |  X   |  C   |  X   |  X   |  X   |------|------|\n  | FC   |  X   |  X   |  P   |  X   |  X   |  X   |  X   |------|\n  | RST  |  X   |  X   |  X   |  X   |  X   |  X   |  O   |  O   |\n  |------|------|------|------|------|------|------|------|------|\n\nThe only difference is with the \u0027P\u0027: another stack could send and\nADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be\nallowed.\n\nA few points of attention:\n\n - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is\n   no reason to add it with a SYN. Note that even with a 4th ACK, it\n   doesn\u0027t seem to be useful, except when IDs are known in advance via\n   another channel. Better not to break that.\n\n - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer\n   result to a reject of the two options, but only the second suboption\n   is ignored. That seems OK to do that for this unexpected error. At\n   least now all inconsistent combinations are handled the same way.\n   This could change later in next. This also means the explicit checks\n   for having both MPC + MPJ in subflow.c will now be unreachable.\n   That\u0027s fine, they will be removed in a follow-up patch.\n\n - In case of conflicting combinations, the extra suboption(s) is/are\n   ignored: having such combinations either means the remote peer is\n   buggy, or is evil. The simplest action is then taken in this case:\n   stop processing the current suboption.\n\n - In mp_opt-\u003esuboptions, there is also a bit reserved to the checksum,\n   which can be used in an MP_CAPABLE and a DSS. Each time a DSS option\n   can be used in parallel with another option, the checksum can be set,\n   so the verification is combined into a new OPTIONS_MPTCP_DSS macro.\n\n - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional\n   Checksum: they are the same as the ones found in a DSS, because a DSS\n   cannot be used in parallel to an MP_CAPABLE. Similarly, even if there\n   is room, a DSS cannot be used with an MP_JOIN."
    }
  ],
  "id": "CVE-2026-80587",
  "lastModified": "2026-08-27T13:18:41.093",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-26T15:17:15.017",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0e2210af439755a2af352eea4178261dcf61742e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-HRRC-RJW8-MJ44

Vulnerability from github – Published: 2026-08-27 06:31 – Updated: 2026-08-27 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

mptcp: avoid combining some incoming suboptions

Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes.

The new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this option [1], which is not the case on Linux. Here are the rules:

Which options can be used together?

X: mutually exclusive O: often used together C: can be used together in some cases P: could be used together but we prefer not to (optimisations)

Opt:	MPC	MPJ	DSS	ADD	RM	PRIO	FAIL	FC
MPC	------	------	------	------	------	------	------	------
MPJ	X	------	------	------	------	------	------	------
DSS	X	X	------	------	------	------	------	------
ADD	X	X	P	------	------	------	------	------
RM	C	C	C	P	------	------	------	------
PRIO	X	C	C	C	C	------	------	------
FAIL	X	X	C	X	X	X	------	------
FC	X	X	P	X	X	X	X	------
RST	X	X	X	X	X	X	O	O
------	------	------	------	------	------	------	------	------

The only difference is with the 'P': another stack could send and ADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be allowed.

A few points of attention:

In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is no reason to add it with a SYN. Note that even with a 4th ACK, it doesn't seem to be useful, except when IDs are known in advance via another channel. Better not to break that.
Now, combining both an MP_CAPABLE and an MP_JOIN will no longer result to a reject of the two options, but only the second suboption is ignored. That seems OK to do that for this unexpected error. At least now all inconsistent combinations are handled the same way. This could change later in next. This also means the explicit checks for having both MPC + MPJ in subflow.c will now be unreachable. That's fine, they will be removed in a follow-up patch.
In case of conflicting combinations, the extra suboption(s) is/are ignored: having such combinations either means the remote peer is buggy, or is evil. The simplest action is then taken in this case: stop processing the current suboption.
In mp_opt->suboptions, there is also a bit reserved to the checksum, which can be used in an MP_CAPABLE and a DSS. Each time a DSS option can be used in parallel with another option, the checksum can be set, so the verification is combined into a new OPTIONS_MPTCP_DSS macro.
An MP_CAPABLE ACK can carry a Data-Level Length, and an optional Checksum: they are the same as the ones found in a DSS, because a DSS cannot be used in parallel to an MP_CAPABLE. Similarly, even if there is room, a DSS cannot be used with an MP_JOIN.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-80587"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-26T15:17:15Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: avoid combining some incoming suboptions\n\nSome MPTCP suboptions are mutually exclusive according to the RFC8684,\nbut also because in different places, the code doesn\u0027t expect some\ncombinations to be present. That\u0027s specially true for suboptions that\nwould be present twice, but with different attributes.\n\nThe new restrictions are the same as the ones applied on the output\nside, with mptcp_write_options. The same rules can be reused with a\nsmall fix: an MP_FASTCLOSE can be used with a DSS when the sender picks\nthis option [1], which is not the case on Linux. Here are the rules:\n\n  Which options can be used together?\n\n  X: mutually exclusive\n  O: often used together\n  C: can be used together in some cases\n  P: could be used together but we prefer not to (optimisations)\n\n  | Opt: | MPC  | MPJ  | DSS  | ADD  |  RM  | PRIO | FAIL |  FC  |\n  |------|------|------|------|------|------|------|------|------|\n  | MPC  |------|------|------|------|------|------|------|------|\n  | MPJ  |  X   |------|------|------|------|------|------|------|\n  | DSS  |  X   |  X   |------|------|------|------|------|------|\n  | ADD  |  X   |  X   |  P   |------|------|------|------|------|\n  | RM   |  C   |  C   |  C   |  P   |------|------|------|------|\n  | PRIO |  X   |  C   |  C   |  C   |  C   |------|------|------|\n  | FAIL |  X   |  X   |  C   |  X   |  X   |  X   |------|------|\n  | FC   |  X   |  X   |  P   |  X   |  X   |  X   |  X   |------|\n  | RST  |  X   |  X   |  X   |  X   |  X   |  X   |  O   |  O   |\n  |------|------|------|------|------|------|------|------|------|\n\nThe only difference is with the \u0027P\u0027: another stack could send and\nADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be\nallowed.\n\nA few points of attention:\n\n - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is\n   no reason to add it with a SYN. Note that even with a 4th ACK, it\n   doesn\u0027t seem to be useful, except when IDs are known in advance via\n   another channel. Better not to break that.\n\n - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer\n   result to a reject of the two options, but only the second suboption\n   is ignored. That seems OK to do that for this unexpected error. At\n   least now all inconsistent combinations are handled the same way.\n   This could change later in next. This also means the explicit checks\n   for having both MPC + MPJ in subflow.c will now be unreachable.\n   That\u0027s fine, they will be removed in a follow-up patch.\n\n - In case of conflicting combinations, the extra suboption(s) is/are\n   ignored: having such combinations either means the remote peer is\n   buggy, or is evil. The simplest action is then taken in this case:\n   stop processing the current suboption.\n\n - In mp_opt-\u003esuboptions, there is also a bit reserved to the checksum,\n   which can be used in an MP_CAPABLE and a DSS. Each time a DSS option\n   can be used in parallel with another option, the checksum can be set,\n   so the verification is combined into a new OPTIONS_MPTCP_DSS macro.\n\n - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional\n   Checksum: they are the same as the ones found in a DSS, because a DSS\n   cannot be used in parallel to an MP_CAPABLE. Similarly, even if there\n   is room, a DSS cannot be used with an MP_JOIN.",
  "id": "GHSA-hrrc-rjw8-mj44",
  "modified": "2026-08-27T15:31:33Z",
  "published": "2026-08-27T06:31:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80587"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0e2210af439755a2af352eea4178261dcf61742e"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-80587 (GCVE-0-2026-80587)

FKIE_CVE-2026-80587

GHSA-HRRC-RJW8-MJ44

Tags

Sightings

Nomenclature