Look up another CVE · open CVE-2026-80585 in the interactive tracker
CVE-2026-80585
mptcp: fastopen: only mark MPTFO subflows with SYN data
Published 2026-08-26 (2 months ago) by the Linux kernel CNA. Subsystem net/mptcp. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-80585 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.105-1 | Update the kernel and reboot. Fixed in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.10-1 | Update the kernel and reboot. Fixed in 7.1.10-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established(). Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty. Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/mptcp/fastopen.c
- What this is
- NETWORKING [MPTCP]MAINTAINERS section matched on net/mptcp/ · netdev@vger.kernel.org · Maintained
Check it on the machine
grep -w CONFIG_MPTCP /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian builds this code. Every release with an answer below compiles the affected file into the kernels it ships. The build rule could not be established for 1 release, so nothing is claimed about those.
- bookworm?
- trixie, forky, sid, bookworm · linux-6.12y
- ?
- not established - no Makefile entry for the affected file
- y
- built into the kernel image on every flavour - only a patch removes it
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_MPTCP
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-26 (2 months ago)source
- CVSS
- 9.4 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.31%, higher than 22.6% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- net/mptcp
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.2 | 6.6.153 | f75f174edc86 |
| 6.2 | 6.12.105 | fca7e444c046 |
| 6.2 | 6.18.46 | 75e564b2ced1 |
| 6.2 | 7.1.10 | 72b4a0c51a4b |
| 6.2 | 7.2 | e00b63056fb4 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- The bug is reached by sending crafted TCP/MPTCP segments to a listening socket over the network (ip4/ip6 receive -> tcp_conn_request/tcp_rcv_state_process -> subflow_prep_synack or mptcp_incoming_options -> check_fully_established); per kernel CNA guidance, net stack packet-handling paths are Network.
- AC:LAttack complexity, low
- In the intended passive-MPTFO deployment (MPTCP listener with net.ipv4.tcp_fastopen server bit set), the attacker controls obtaining a valid TFO cookie and then sending a data-less SYN followed by an out-of-order MPC_ACK to deterministically hit the stale is_mptfo path in check_fully_established().
- PR:NPrivileges required, none
- Exploitation requires only unauthenticated inbound TCP connections to an MPTCP listener; the attacker obtains the TFO cookie from their own prior connection and needs no local account, capability, or namespace privileges on the target host.
- UI:NUser interaction, none
- No victim interaction is required beyond the server normally accepting TCP connections; the attacker programmatically sends the SYN and follow-up MPC_ACK packets without anyone opening files, clicking links, or performing other actions.
- S:UScope, unchanged
- Impact is confined to kernel MPTCP/TCP connection state on the target host and does not cross VM, container, IOMMU, or other security boundaries; it is not a sandbox or guest-to-host escape.
- C:LConfidentiality impact, low
- Premature fully_established with attacker-chosen MPTCP keys desynchronizes handshake and DSS/map state, enabling misdelivery or premature exposure of connection-level data/metadata to the remote peer before normal MP_CAPABLE validation completes.
- I:HIntegrity impact, high
- Stale is_mptfo lets an out-of-order MPC_ACK force __mptcp_subflow_fully_established(), writing attacker-controlled sndr_key/ack_seq into msk and subflow crypto state and corrupting subsequent DSS/ACK handling on the server multipath socket.
- A:HAvailability impact, high
- Data-less passive-TFO SYNs hit WARN_ON_ONCE(!skb) on every trigger, and the resulting inconsistent is_mptfo/fully_established state can cause repeatable kernel WARN/oops (panic_on_warn panic) plus connection reset storms against internet-facing MPTCP servers.