CVE-2026-80585Critical· 9.4▾ Midnight

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's …

▾ Midnight zone — Critical, or high with PoC / in-the-wild

Depth score52/ 100 · Moderate

impact 51.7 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Aug 26, 2026

Updated

Oct 16, 2026

CVSS

9.4

Vendor

Linux

Product

Linux

CWE

—

Depth score

52 · Moderate

EPSS

0.31% · p24

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: yes
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Oct 16.

0.3% → 0.3%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 51 days

Aug 26, 2026Published
Disclosed via NVD
Oct 16, 2026Record revised
Last analysed / modified upstream
Oct 16, 2026EPSS first tracked
0.3%

Linux #nvd #cve.org

Affected

Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < f75f174edc865738522e514d042cf5627f084859
Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < fca7e444c04689fe4cc6b56f2725f804a4bb1ef9
Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < 75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5
Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < 72b4a0c51a4b550d40301d60a366b429b8c8e78d
Linux >= 36b122baf6a8bd46b4a591f12f4ed17b22257408 < e00b63056fb4f261455b3e5df5268a1f8ce47a87
Linux 6.2

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fastopen: only mark MPTFO subflows with SYN data

Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty.

mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established().

Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty.

Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org