« Back to list

CVE-2026-80586

Status: ReceivedCritical (9.8)—

In the Linux kernel, the following vulnerability has been resolved:

mptcp: options: reset DSS fields in case of unexpected size

A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data.

Explicitly reset the fields that could have been modified in case of unexpected size.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Red sin autenticación (AV:N/PR:N) permite envío remoto de paquetes MPTCP malformados (DSS) causando inconsistencia de memoria o lectura de datos no inicializados en kernel Linux.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Vulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkFilter Network TrafficApplication Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Linux — Linux KernelAI

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2026-80586",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "15e35fdad7a5576bf3f1c8d688877aeb5d1b506b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "b1256090816ec46011601e084be580731df58fc7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "192878df582c51d440bf7b91a15f297f29f2b596",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "26dac5c9ffb20812b475fdf253eb04fab99cff3b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "4e80eff5c1c893aca2ac1d202f0b256d2e52ecde",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "1fade1b2ac5b1a4948e538fae7313bea57b5ac36",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "27ed642a4e7e4b5df4b8522c72c457a67e052493",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "648ef4b88673dadb8463bf0d4b10fbf33d55def8",
              "lessThan": "35772b4981f38ba8059372cde8753e8e477e98ec",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/mptcp/options.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.266",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.217",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.184",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.153",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.105",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.46",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.10",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/mptcp/options.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-08-26T15:17:14.873",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4e80eff5c1c893aca2ac1d202f0b256d2e52ecde",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b1256090816ec46011601e084be580731df58fc7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: options: reset DSS fields in case of unexpected size\n\nA remote peer could send a malformed DSS with a wrong size, followed by\nanother DSS or MPC + Data. In this case, the first suboption will be\nignored, but leaving some fields written, which could lead to\ninconsistency or access uninitialized data.\n\nExplicitly reset the fields that could have been modified in case of\nunexpected size."
    }
  ],
  "lastModified": "2026-08-27T06:17:45.700",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}