Critical severity · published Aug 26, 2026
CVE-2026-80586
mptcp: options: reset DSS fields in case of unexpected size
9.8
CVSS
0.4%
EPSS
No
On KEV
Description
In the Linux kernel, the following vulnerability has been resolved:
mptcp: options: reset DSS fields in case of unexpected size
A remote peer could send a malformed DSS with a wrong size, followed by
another DSS or MPC + Data. In this case, the first suboption will be
ignored, but leaving some fields written, which could lead to
inconsistency or access uninitialized data.
Explicitly reset the fields that could have been modified in case of
unexpected size.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Linux · Linux
648ef4b88673dadb8463bf0d4b10fbf33d55def8 before 15e35fdad7a5576bf3f1c8d688877aeb5d1b506b; 648ef4b88673dadb8463bf0d4b10fbf33d55def8 before b1256090816ec46011601e084be580731df58fc7; 648ef4b88673dadb8463bf0d4b10fbf33d55def8 before 192878df582c51d440bf7b91a15f297f29f2b596; 648ef4b88673dadb8463bf0d4b10fbf33d55def8 before 26dac5c9ffb20812b475fdf253eb04fab99cff3b; 648ef4b88673dadb8463bf0d4b10fbf33d55def8 before 4e80eff5c1c893aca2ac1d202f0b256d2e52ecde; 648ef4b88673dadb8463bf0d4b10fbf33d55def8 before 1fade1b2ac5b1a4948e538fae7313bea57b5ac36; +3 more · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-80586
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-80586
git.kernel.org
https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b
git.kernel.org
https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596
git.kernel.org
https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36
git.kernel.org
https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b
git.kernel.org
https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493
git.kernel.org
https://git.kernel.org/stable/c/35772b4981f38ba8059372cde8753e8e477e98ec
More from Linux
9.8
CVE-2025-39682
tls: fix handling of zero-length records on the rx_list
8.8
CVE-2026-53266
netfilter: bridge: make ebt_snat ARP rewrite writable
7.8
CVE-2026-53362
ipv6: account for fraggap on the paged allocation path
7.8
CVE-2026-31431
crypto: algif_aead - Revert to operating out-of-place
7.8
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()