CVE-2026-80588

A flaw was found in the Linux kernel's Multipath TCP (mptcp) implementation. Errors occurring during the receive path, before data is queued, may prevent the system from reclaiming forward-allocated memory. This can lead to an unbounded increase in memory usage under certain network conditions, such as high packet loss. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) by exhausting available system memory.

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation, rated by Red Hat Product Security as having MODERATE impact. In the MPTCP receive path, when errors occur before received socket buffers (skbs) are queued into the receive queue, forward-allocated memory that was borrowed from the subflow (since upstream commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow") is not reclaimed. Under pathological drop scenarios, such as sustained packet loss on MPTCP connections, this allows forward-allocated memory to grow without bound. A remote attacker able to exchange MPTCP traffic with an affected system could exploit this to exhaust kernel memory and cause a denial of service. There is no impact on confidentiality or integrity; the impact is limited to availability. Red Hat Enterprise Linux 6, 7, and 8 are marked not affected because the vulnerable code is not present in those streams, while Red Hat Enterprise Linux 9 and 10 and Red Hat In-Vehicle OS 2 are affected. For the affected streams the fix is currently deferred and will be addressed in a future update; the residual risk while the fix is deferred is that systems using MPTCP on networks that can sustain receive-path errors or high packet loss may experience unbounded memory growth leading to memory exhaustion and denial of service. Red Hat rates this flaw MODERATE with a CVSS 3.1 score of 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the upstream CVEORG score of 7.5 IMPORTANT (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), reflecting Red Hat's assessment that practical exploitation requires sustained MPTCP traffic under specific receive-path error conditions rather than a single simple network action.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.