CVE-2026-80585 Overview
CVE-2026-80585 is a state confusion vulnerability in the Linux kernel's Multipath TCP (MPTCP) fastopen implementation. The flaw resides in mptcp_fastopen_subflow_synack_set_params(), which sets the is_mptfo flag before verifying that queued SYN data exists. Passive TCP Fast Open (TFO) accepts a valid-cookie SYN even when it carries no data, leaving the child socket's receive queue empty. A data-less TFO SYN triggers a WARN and, when the warning is non-fatal, leaves stale MPTFO state. That stale flag can later trigger a state-confusion condition inside check_fully_established().
Critical Impact
Remote attackers can reach the vulnerable code path over the network without authentication, corrupting MPTCP subflow state and impacting kernel integrity and availability.
Affected Products
- Linux kernel branches implementing MPTCP fastopen (net/mptcp/) prior to the fixes referenced in the upstream commits
- Distributions shipping vulnerable stable kernels pending backport
- Systems with MPTCP enabled and TCP Fast Open accepted on listening sockets
Discovery Timeline
- 2026-08-26 - CVE-2026-80585 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-80585
Vulnerability Analysis
MPTCP extends TCP with multiple concurrent subflows. TCP Fast Open (TFO) permits data delivery in the SYN itself when a valid cookie is presented. In passive TFO, the kernel accepts a valid-cookie SYN even when it does not carry any payload, and the resulting child socket has an empty receive queue.
The function mptcp_fastopen_subflow_synack_set_params() marked the subflow with is_mptfo = true before checking whether an SKB was actually queued from the SYN. When no data was carried, the code path hit a WARN. If the warning was configured as non-fatal, execution continued and the subflow retained the is_mptfo flag without ever consuming SYN data. This inconsistency between the flag and the true subflow state feeds into later logic in check_fully_established(), producing a state-confusion condition that undermines protocol integrity.
Root Cause
The root cause is a business logic error in the ordering of state mutations. The subflow was labeled as an MPTFO subflow before confirming the precondition that defines MPTFO: SYN-carried data queued to the socket. This violates the invariant that mptcp_subflow_context->is_mptfo implies consumed SYN data.
Attack Vector
A remote peer that has previously obtained a valid TFO cookie can send a data-less SYN with that cookie to a listening MPTCP endpoint. The malformed sequence forces the vulnerable code path, sets the is_mptfo flag on a subflow with no queued data, and later drives check_fully_established() down an inconsistent branch. No authentication is required and the attack is reachable over the network.
No verified exploit code is available. Refer to the upstream commits 72b4a0c, 75e564b, e00b630, f75f174, and fca7e44 for the corrective patches.
Detection Methods for CVE-2026-80585
Indicators of Compromise
- Kernel log entries containing WARN messages originating from mptcp_fastopen_subflow_synack_set_params or nearby MPTCP fastopen code paths.
- Anomalous MPTCP session terminations or handshake failures following data-less TFO SYN packets from external peers.
- Repeated inbound SYN packets carrying TFO cookies but zero payload targeted at MPTCP-enabled services.
Detection Strategies
- Monitor dmesg and journalctl -k for MPTCP-related WARN_ON traces on hosts running MPTCP workloads.
- Correlate kernel warnings with network telemetry showing SYN packets that include a TFO cookie option and an empty data segment.
- Track MPTCP subflow counters (nstat, ss -M) for unexpected drops or resets tied to specific source IPs.
Monitoring Recommendations
- Ingest kernel logs into a centralized platform and alert on MPTCP WARN signatures.
- Baseline TFO usage per service and flag sources sending TFO SYNs with no payload.
- Track kernel version and patch level across Linux fleets to identify hosts still exposed to CVE-2026-80585.
How to Mitigate CVE-2026-80585
Immediate Actions Required
- Apply distribution kernel updates that incorporate the upstream MPTCP fastopen fix as soon as they are available.
- Where MPTCP is not required, disable it to remove the attack surface (sysctl net.mptcp.enabled=0).
- Restrict inbound access to MPTCP-enabled services to trusted network segments until patched kernels are deployed.
Patch Information
Upstream Linux resolves CVE-2026-80585 by marking the subflow as MPTFO only after confirming an SKB was queued, and by returning quietly when the receive queue is empty. The fix redefines mptcp_subflow_context->is_mptfo to represent MPTFO subflows that consumed SYN data. Apply commits 72b4a0c, 75e564b, e00b630, f75f174, and fca7e44 or the corresponding stable backports.
Workarounds
- Disable TCP Fast Open server-side acceptance by clearing the server bit in net.ipv4.tcp_fastopen on affected hosts.
- Disable MPTCP where the feature is not in use to eliminate the vulnerable code path entirely.
- Configure panic_on_warn=0 cautiously; do not rely on warning-only behavior as a security control, since it is precisely the condition that enables the stale state.
# Configuration example
# Disable MPTCP if not required
sudo sysctl -w net.mptcp.enabled=0
# Disable server-side TCP Fast Open (bit 0x2)
sudo sysctl -w net.ipv4.tcp_fastopen=1
# Persist across reboots
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-cve-2026-80585.conf
echo 'net.ipv4.tcp_fastopen=1' | sudo tee -a /etc/sysctl.d/99-cve-2026-80585.conf
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
