CVE-2026-80586
CriticalCVSS 9.8Summary
In the Linux kernel's MPTCP module, a remote peer can send a malformed DSS with an incorrect size, causing the first suboption to be ignored but leaving some fields written, potentially leading to inconsistency or access to uninitialized data. The fix explicitly resets fields that could have been modified in case of unexpected size.
Risk Assessment
An attacker could exploit this vulnerability to cause state inconsistency or access uninitialized data, potentially leading to system crash or privilege escalation.
Recommendation
Apply the Linux kernel update containing the fix for CVE-2026-80586.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the fields that could have been modified in case of unexpected size.