CVE-2026-80586: Linux Kernel MPTCP Information Disclosure

CVE-2026-80586 Overview

CVE-2026-80586 is a Linux kernel vulnerability in the Multipath TCP (MPTCP) subsystem. The flaw resides in the DSS (Data Sequence Signal) option parsing logic. A remote peer can send a malformed DSS suboption with an unexpected size, followed by another DSS or MPC + Data option. The kernel ignores the first suboption but leaves partially written fields in place, leading to inconsistent state or access to uninitialized data. The fix explicitly resets the affected fields when an unexpected size is detected.

Critical Impact
Remote unauthenticated attackers can trigger uninitialized memory access in the kernel MPTCP stack over the network, with potential for information disclosure, corruption of MPTCP session state, or denial of service.

Affected Products

Linux kernel MPTCP subsystem (net/mptcp/options.c)
Stable kernel branches referenced in the upstream fix commits
Systems with MPTCP enabled and reachable over the network

Discovery Timeline

2026-08-26 - CVE-2026-80586 published to the National Vulnerability Database
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80586

Vulnerability Analysis

The vulnerability is an uninitialized memory use issue in the MPTCP option parser. MPTCP negotiates and multiplexes multiple subflows on a single logical connection. The DSS option carries data sequence mapping information used to reassemble streams across subflows.

When the parser encounters a DSS suboption whose size does not match the expected layout, it aborts processing that suboption. However, prior to bailing out, the parser writes several fields in the shared option-parsing structure. Those partial writes remain visible when the next option in the same TCP packet is parsed.

A follow-up DSS option or an MP_CAPABLE (MPC) option combined with data can then observe fields that appear valid but reflect leftover values from the malformed suboption. Downstream logic treats these fields as trustworthy, producing inconsistent MPTCP state or acting on uninitialized data.

Root Cause

The DSS parser did not reset fields it had already written when it detected an unexpected suboption size. The parser lacked an all-or-nothing invariant on the option state structure. The upstream patch explicitly clears the fields that could have been modified before returning from the size-mismatch path.

Attack Vector

Exploitation requires the ability to send crafted TCP segments to an MPTCP-enabled endpoint. No authentication or user interaction is required. An attacker constructs a TCP segment containing a malformed DSS suboption with an incorrect length, followed by a second DSS or an MPC option carrying data. The parser processes both suboptions in sequence, and the second suboption inherits residual field values from the first.

// Verified technical details are available in the upstream commits.
// See the kernel commit references for the exact parser paths
// and the reset logic added to net/mptcp/options.c.

Detection Methods for CVE-2026-80586

Indicators of Compromise

Unexpected MPTCP subflow terminations or resets on endpoints exposing MPTCP
Kernel log entries referencing MPTCP option parsing anomalies or malformed DSS
Anomalous inbound TCP segments containing back-to-back MPTCP option suboptions with mismatched length fields

Detection Strategies

Inspect network telemetry for TCP segments carrying multiple MPTCP options where DSS length fields do not match the documented option layout
Correlate MPTCP-enabled host crashes or subflow anomalies with inbound traffic patterns from external peers
Compare running kernel versions against the fixed commits referenced in the upstream MPTCP fix

Monitoring Recommendations

Enable auditing on kernel modules that expose MPTCP and forward relevant events to a centralized SIEM
Monitor dmesg and journalctl -k output for MPTCP warnings across the fleet
Track outbound and inbound MPTCP-tagged flows on hosts where MPTCP is not required, to identify unnecessary exposure

How to Mitigate CVE-2026-80586

Immediate Actions Required

Inventory Linux hosts with MPTCP enabled by checking /proc/sys/net/mptcp/enabled
Apply the fixed stable kernel from your distribution vendor once available
Disable MPTCP on systems that do not require it until the patched kernel is deployed

Patch Information

The fix explicitly resets DSS fields in the option-parsing state when an unexpected suboption size is detected. The relevant upstream commits are published on kernel.org, including commit 192878df5, commit 15e35fdad, commit 1fade1b2a, commit 26dac5c9f, commit 27ed642a4, commit 35772b49, commit 4e80eff5c, and commit b12560908. Track the corresponding backport advisories from your Linux distribution.

Workarounds

Disable MPTCP system-wide by setting net.mptcp.enabled=0 via sysctl on hosts that do not use MPTCP
Restrict inbound TCP traffic to MPTCP-enabled services using host and network firewalls
Prevent applications from opting into MPTCP sockets by removing IPPROTO_MPTCP usage where feasible

bash

# Disable MPTCP at runtime and persist across reboots
sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' > /etc/sysctl.d/99-disable-mptcp.conf

# Verify MPTCP is disabled
cat /proc/sys/net/mptcp/enabled