CVE-2026-80585

A flaw was found in the Linux kernel. In the Multipath TCP (MPTCP) Fast Open feature, a vulnerability exists where the system incorrectly marks a subflow as MPTFO even when a TCP Fast Open (TFO) SYN packet does not contain data. This can lead to a stale MPTFO state, potentially triggering a state-confusion bug in the check_fully_established() function. This could result in system instability or a denial of service.

MPTCP Fast Open handling can mark a subflow as MPTFO before confirming that SYN data was queued on the child socket. A remote client with a valid TCP Fast Open cookie can send a data-less TFO SYN, causing a WARN and leaving stale MPTFO state if the warning is non fatal. That stale flag can later confuse check_fully_established and may affect connection state handling or availability. For the CVSS the PR:N is used because the attacker does not need local access or authenticated privileges on the target, only network reachability to an MPTCP/TFO listener and a valid TFO cookie. The issue is network reachable when passive TCP Fast Open and MPTCP are enabled on an exposed service. Impact is primarily denial of service through WARN/panic configurations or state confusion, with no concrete evidence of information disclosure or arbitrary write from the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.