CVE-2026-80847: Linux Kernel TCP DOS Vulnerability

CVE-2026-80847 Overview

CVE-2026-80847 is a Linux kernel vulnerability in the TCP subsystem. The function tcp_select_initial_window() assumes callers never pass a Maximum Segment Size (MSS) smaller than 1. Route-derived advmss values can violate that assumption and trigger a divide-by-zero condition in kernel space.

The issue is reachable through an explicit RTAX_ADVMSS route metric that is set too small. It is also reachable through the default advmss path when RTAX_ADVMSS remains 0 and the effective advmss is driven down by route Maximum Transmission Unit (MTU) and min_adv_mss. Either path can drop the effective MSS to zero before the receive window is rounded.

Critical Impact
A divide-by-zero in tcp_select_initial_window() can trigger a kernel fault, causing denial of service on affected Linux systems that process crafted or misconfigured route metrics.

Affected Products

Linux kernel (upstream mainline)
Linux kernel stable branches referenced in the fix commits
Downstream distributions shipping unpatched kernels with the affected TCP advmss handling

Discovery Timeline

2026-09-04 - CVE-2026-80847 published to the National Vulnerability Database (NVD)
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-80847

Vulnerability Analysis

The defect resides in the Linux kernel TCP stack. tcp_select_initial_window() uses the MSS value provided by callers as a divisor when computing the initial receive window. The function does not validate that the MSS is greater than zero.

Callers in the TCP paths derive advmss from destination (dst) metrics. When those metrics yield an advmss of zero, the subsequent division inside tcp_select_initial_window() faults. The fix introduces a tcp_dst_advmss() helper that clamps route advmss to TCP_MIN_MSS before TCP consumes the value. This prevents the effective MSS from reaching zero.

The class of defect maps to a Denial of Service via Divide-by-Zero condition in kernel code, reachable through routing metadata rather than direct network payloads.

Root Cause

The root cause is missing input validation on route-derived advmss values consumed by TCP. Two paths lead to a zero MSS: an explicit RTAX_ADVMSS metric set below TCP_MIN_MSS, and the default advmss path where the effective value is reduced by route MTU and min_adv_mss after RTAX_ADVMSS is left at 0.

Attack Vector

Exploitation requires influencing route metrics that the kernel later feeds into TCP window calculations. A local actor with the capability to install or modify routes, or a scenario where administrator-supplied metrics interact with a low MTU, can drive advmss to zero. The result is a kernel fault on TCP connection setup, producing a denial of service condition rather than code execution.

No verified public exploit code is available. Refer to the upstream commits linked in the references for the patched call sites and the new tcp_dst_advmss() helper.

Detection Methods for CVE-2026-80847

Indicators of Compromise

Kernel oops or panic entries in dmesg or journalctl -k referencing tcp_select_initial_window or divide error faults in the TCP path
Repeated crashes correlated with TCP socket creation on hosts that consume dynamic routing updates
Unexpected route entries with abnormally small RTAX_ADVMSS values or very low MTU on active routes

Detection Strategies

Audit installed routes for advmss and mtu values below TCP_MIN_MSS (typically 88 bytes) using ip route show and comparable tooling
Monitor kernel log ingestion for divide error traps originating in the TCP subsystem
Track processes and users invoking ip route or RTM_NEWROUTE netlink operations that set RTAX_ADVMSS

Monitoring Recommendations

Forward kernel logs to a centralized logging pipeline and alert on kernel divide-by-zero traces
Baseline route metric changes on servers with dynamic routing daemons and alert on anomalies
Track kernel version inventory and flag hosts running unpatched Linux stable branches referenced in the upstream commits

How to Mitigate CVE-2026-80847

Immediate Actions Required

Identify Linux hosts running kernels that predate the tcp_dst_advmss() clamp and schedule patching
Restrict privileges to modify routing tables to trusted administrators and automation accounts
Review existing route metrics and remove any RTAX_ADVMSS values below TCP_MIN_MSS

Patch Information

Apply the upstream kernel fix that introduces tcp_dst_advmss() and clamps route advmss to TCP_MIN_MSS. The relevant commits are available at Linux Kernel Commit 31cf234, Linux Kernel Commit 6b8c20b, Linux Kernel Commit 870a9e4, and Linux Kernel Commit cfb44c6. Consult your distribution vendor for backported package releases.

Workarounds

Enforce a minimum advmss in operational tooling and configuration management to prevent values below TCP_MIN_MSS
Validate MTU and advmss metrics before applying route changes on production hosts
Limit CAP_NET_ADMIN privileges to reduce the population of accounts able to install harmful route metrics

bash

# Configuration example: audit routes for low advmss values
ip route show | grep -E 'advmss [0-9]{1,2}( |$)'

# Enumerate current kernel version to confirm patch level
uname -r