Executive brief
The Linux kernel's MPTCP (Multipath TCP) networking stack contains a flaw in how it handles TCP Fast Open subflows during connection establishment. A specially crafted network packet sequence can trigger a state-confusion bug that allows an attacker to cause kernel warnings, incorrect state tracking, and potential service disruption or privilege escalation on systems using MPTCP.
Technical details
The vulnerability exists in the MPTCP fastopen implementation (net/mptcp/fastopen.c) where the mptcp_fastopen_subflow_synack_set_params() function incorrectly sets the is_mptfo (MPTCP Fast Open) flag before validating that SYN data was actually queued. Passive TCP Fast Open accepts valid-cookie SYN packets even without data payload, but the code path failed to account for this condition. When data-less TFO SYNs were processed, the function would set is_mptfo=1 prematurely, trigger a WARN_ON_ONCE, and leave stale MPTFO state in the subflow context. This stale flag could subsequently cause state-confusion bugs in check_fully_established(), leading to incorrect connection handling. The fix reorders the logic to only mark is_mptfo=1 after confirming an SKB is present in the receive queue.
Affected products
- Linux Linux kernel Multiple versions (patch available in stable releases)
Timeline
- 2026-08-26: disclosed: CVE-2026-80585 published
- 2026-08-23: patched: Fix merged into stable kernel tree (commits 72b4a0c51a4b, 75e564b2ced1c)