SECUFOCUSNOW
Home›CVE index›CVE-2026-80587
ReviewCritical

CVE-2026-80587

Linux

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes. The new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this optio...

CVSS
9.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.08.27
PRIORITY ASSESSMENT

Review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes. The new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this optio...

Affected product and versions

Product
Linux
Affected versions
>= eda7acddf8080bb2d022a8d4b8b2345eb80c63ec < 0e2210af439755a2af352eea4178261dcf61742e, >= eda7acddf8080bb2d022a8d4b8b2345eb80c63ec < dc1d8d3eb345c616fbe922a010fa391c72c54d52, >= eda7acddf8080bb2d022a8d4b8b2345eb80c63ec < 099bfcbd0c16ae9b50aba2a1bea033e63f895da7, >= eda7acddf8080bb2d022a8d4b8b2345eb80c63ec < a04dcc784959e4702048785d87e0d029bd2fbdcb, >= eda7acddf8080bb2d022a8d4b8b2345eb80c63ec < 6bab907292155513af397a12ccb488acbfc30d79, >= eda7acddf8080bb2d022a8d4b8b2345eb80c63ec < b6ee361524641f57b2e2363f7737f20e17f67827, >= 5.6
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available