CVE-2026-80588: Linux Kernel MPTCP Memory Vulnerability

CVE-2026-80588 Overview

CVE-2026-80588 affects the Multipath TCP (MPTCP) subsystem in the Linux kernel. The vulnerability allows forward-allocated memory to grow without bound when the receive path drops packets before queueing them. A remote attacker can trigger pathological drop scenarios over the network to exhaust kernel memory. The flaw was introduced by commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), which failed to reclaim forward-allocated memory on RX path errors. The Linux kernel maintainers have resolved the issue in stable branches.

Critical Impact
Remote, unauthenticated attackers can exhaust kernel memory through MPTCP receive-path packet drops, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow")
Linux distributions shipping MPTCP-enabled kernels prior to the fix
Stable kernel trees pending backport of commits 41b49a8, 473f1a5, and 8277f48

Discovery Timeline

2026-08-26 - CVE-2026-80588 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80588

Vulnerability Analysis

The vulnerability resides in the Linux kernel MPTCP receive path. MPTCP aggregates multiple TCP subflows and uses a forward-allocation memory model to reserve socket buffer space ahead of arriving data. The parent commit 9db5b3cec4ec introduced a mechanism to borrow forward-allocated memory from subflows into the MPTCP socket.

When the receive path encounters an error before an sk_buff (skb) is queued into the receive queue, the associated forward-allocated memory is not returned. Each dropped packet leaks reservation accounting from the socket's forward allocation counter. An attacker who can push MPTCP traffic that reliably triggers RX-path drops can drive forward-allocated memory to grow indefinitely on the target host.

The defect maps to a resource exhaustion condition affecting availability. It requires no authentication and no user interaction. Successful exploitation degrades or halts services depending on kernel memory pressure and out-of-memory (OOM) handler behavior.

Root Cause

The root cause is missing reclamation logic in the MPTCP receive path. When sk_buff structures are dropped prior to being enqueued, the code path skips the branch that returns borrowed forward memory to the subflow. Forward-allocation accounting therefore diverges from actual buffer usage and monotonically increases under sustained drop conditions.

Attack Vector

Exploitation is network-based. An attacker sends MPTCP segments crafted or timed to trigger receive-path drops, such as invalid sequence numbers, checksum mismatches, or resource limits, against a listening service that accepts MPTCP connections. Sustained traffic causes forward-allocated memory to accumulate until the kernel exhausts available memory and DoS occurs.

No verified public exploit code is available. Refer to the upstream fixes for technical details: Kernel Git Commit 41b49a8, Kernel Git Commit 473f1a5, and Kernel Git Commit 8277f48.

Detection Methods for CVE-2026-80588

Indicators of Compromise

Continuously rising sk_forward_alloc values on MPTCP sockets without corresponding growth in queued data
Kernel OOM killer events on hosts exposing MPTCP-enabled services to untrusted networks
Elevated MPTCP drop counters in /proc/net/netstat alongside abnormal socket memory growth

Detection Strategies

Baseline per-socket forward-allocation counters through ss -m and alert on unbounded growth on MPTCP listeners
Correlate MPTCP MIB counters (MPTcpExtDataCsumErr, MPTcpExtOFOQueueTail, MPTcpExtDuplicateData) with socket memory metrics
Monitor kernel logs for repeated mptcp warnings, drops, and OOM invocations tied to network-facing workloads

Monitoring Recommendations

Ingest kernel telemetry, /proc/net/netstat, and /proc/net/sockstat into a centralized analytics platform for trend analysis
Alert on sustained increases in slab allocations for skbuff_head_cache on hosts running MPTCP services
Track running kernel versions across the fleet and flag hosts still on unpatched branches

How to Mitigate CVE-2026-80588

Immediate Actions Required

Apply the upstream fixes referenced by commits 41b49a8, 473f1a5, and 8277f48 from the stable kernel tree
Update to distribution kernel packages that incorporate these MPTCP reclaim fixes as soon as vendors publish them
Restrict exposure of MPTCP-enabled services to trusted networks until patched kernels are deployed

Patch Information

The fix reclaims forward-allocated memory explicitly when skbs are dropped in the MPTCP receive path. The corrections landed in the mainline and stable branches through the commits listed in the Kernel Git Commit 41b49a8, Kernel Git Commit 473f1a5, and Kernel Git Commit 8277f48 references.

Workarounds

Disable MPTCP on hosts that do not require it by setting net.mptcp.enabled=0 via sysctl
Terminate MPTCP at a patched load balancer or proxy to shield backend kernels
Apply network filtering to limit MPTCP connections to trusted peers where the protocol is required

bash

# Disable MPTCP system-wide until patched kernels are deployed
sudo sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

# Verify running kernel version and MPTCP state
uname -r
sysctl net.mptcp.enabled