PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-80585 Linux CVE debrief

A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation could allow an attacker to trigger a warning and leave behind stale MPTFO state. The issue arises from the incorrect marking of MPTFO subflows with SYN data. This vulnerability has been resolved in the Linux kernel. The problem was identified in the mptcp_fastopen_subflow_synack_set_params function, where the subflow was marked as MPTFO before checking for queued SYN data. This could lead to stale MPTFO state being left behind if the receive queue was empty.

Vendor
Linux
Product
Unknown
CVSS
CRITICAL 9.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-26
Original CVE updated
2026-10-16
Advisory published
2026-08-26
Advisory updated
2026-10-16

Who should care

Defenders responsible for Linux kernel maintenance and MPTCP configuration should assess their exposure and apply patches to prevent potential issues. They should also review system configurations for MPTCP usage and monitor subflows for potential problems. Additionally, defenders should verify Linux kernel versions to ensure patches are applied and track exceptions, retest remediated assets, and close the item only after evidence is documented. Security,

Why it matters

A vulnerability in the Linux kernel's MPTCP implementation could allow an attacker to trigger a warning and leave behind stale MPTFO state. Defenders should prioritize verifying their Linux kernel versions and applying patches.

  • Verify Linux kernel versions to ensure patches are applied
  • Monitor MPTCP subflows for potential issues
  • Review system configurations for MPTCP usage

Technical summary

The Linux kernel's MPTCP implementation had a vulnerability where MPTFO subflows were incorrectly marked with SYN data. This could trigger a warning and leave behind stale MPTFO state. The issue has been resolved by modifying the mptcp_fastopen_subflow_synack_set_params function to only mark subflows as MPTFO after confirming that an SKB was queued. The fix ensures that subflows are accurately marked and stale state is not left behind, preventing potential issues with MPTCP subflows. The vulnerability was addressed by changing the logic in the mptcp_fastopen_subflow_synack_set_params function.

Defensive priority

Defenders should prioritize verifying their Linux kernel versions and applying patches to prevent potential issues with MPTCP subflows.

Recommended defensive actions

  • Verify Linux kernel versions and apply patches
  • Monitor MPTCP subflows for potential issues
  • Review system configurations for MPTCP usage
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability was introduced in the Linux kernel's MPTCP implementation. The issue was resolved by modifying the mptcp_fastopen_subflow_synack_set_params function to only mark subflows as MPTFO after confirming that an SKB was queued.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-80585 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-80585

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-80585 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-80585

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • mptcp: fastopen: only mark MPTFO subflows with SYN data

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/80xxx/CVE-2026-80585.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.