« Volver al listado

CVE-2026-80585

Estado: RecibidaCrítica (9.4)—

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fastopen: only mark MPTFO subflows with SYN data

Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty.

mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established().

Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty.

Leer descripción completaMostrar menos

Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad remota en kernel Linux sin autenticación (AV:N, PR:N, UI:N) que causa confusión de estado mediante TCP Fast Open malformado, permitiendo DoS y escalada; impacto crítico (I:H, A:H) en disponibilidad y control.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80585",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.4,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 5.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "lessThan": "f75f174edc865738522e514d042cf5627f084859",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "lessThan": "fca7e444c04689fe4cc6b56f2725f804a4bb1ef9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "lessThan": "75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "lessThan": "72b4a0c51a4b550d40301d60a366b429b8c8e78d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "36b122baf6a8bd46b4a591f12f4ed17b22257408",
              "lessThan": "e00b63056fb4f261455b3e5df5268a1f8ce47a87",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.2"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "6.2",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/mptcp/fastopen.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-26T15:17:14.750",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fastopen: only mark MPTFO subflows with SYN data\n\nPassive TCP Fast Open accepts a valid-cookie SYN even when it carries\nno data. In that case the child socket's receive queue is intentionally\nleft empty.\n\nmptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking\nfor queued SYN data. That made data-less TFO SYNs hit a WARN and, if\nthe warning was non-fatal, left stale MPTFO state behind. The stale\nflag could later trigger a state-confusion bug in\ncheck_fully_established().\n\nOnly mark the subflow as MPTFO after confirming that an SKB was queued.\nReturn quietly when the receive queue is empty.\n\nNote that mptcp_subflow_context's is_mptfo field is now not just about\nsubflows where the TFO was present, but about MPTFO subflow that\nconsumed SYN data. Only having a valid cookie but not carrying data is\nnot really \"doing TFO\"."
    }
  ],
  "lastModified": "2026-08-27T06:17:45.397",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}