CRITICAL Introduced in 5.6
mptcp DSS Corruption
CVE-2026-80586
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI9.8CRITICAL
01Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the fields that could have been modified in case of unexpected size.
02KernelScan AI Analysis
Risk summary
A remote attacker can exploit this vulnerability by sending a malformed MPTCP DSS option to a target system, causing the kernel to process stale or uninitialized data fields. This can lead to memory corruption, information disclosure, or system instability, posing a critical risk to any system utilizing MPTCP over an exposed network.
Vulnerability analysis
When parsing an incoming MPTCP DSS option with an unexpected size, the kernel rejects the option but fails to clear fields that were already partially written from the option header. If the same packet contains a subsequent valid suboption, the parser carries over stale DSS flags and lengths, causing the receive path to operate on inconsistent or uninitialized state. The fix explicitly zeroes all DSS-related fields before discarding the malformed option, ensuring a clean slate for any following suboption. Any remote peer that can establish an MPTCP connection to the target can trigger this by sending a crafted TCP option, requiring no privileges.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.6 | 5.10.266 | 15e35fdad7a5 |
| 5.15 | 5.6 | 5.15.217 | b1256090816e |
| 6.1 | 5.6 | 6.1.184 | 192878df582c |
| 6.12 | 5.6 | 6.12.105 | 4e80eff5c1c8 |
| 6.18 | 5.6 | 6.18.46 | 1fade1b2ac5b |
| 6.6 | 5.6 | 6.6.153 | 26dac5c9ffb2 |
| 7.1 | 5.6 | 7.1.10 | 27ed642a4e7e |
| mainline | 5.6 | 7.2 | 35772b4981f3 |
| cip/5.10 | 5.6 | 5.10.268-cip77 | 15e35fdad7a5 |
| cip/5.10-rt | 5.6 | 5.10.268-cip77-rt34 | 15e35fdad7a5 |
| cip/6.1 | 5.6 | 6.1.187-cip60 | 192878df582c |
| cip/6.1-rt | 5.6 | 6.1.189-cip61-rt32 | 192878df582c |
| cip/6.12 | 5.6 | 6.12.108-cip31 | 4e80eff5c1c8 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.108-cip31 |
| cip/6.1 | Fixed in 6.1.187-cip60 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Fixed in 5.10.268-cip77 |
| cip/5.10-rt | Fixed in 5.10.268-cip77-rt34 |