CVE-2026-80586: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80586 is a Linux kernel vulnerability in the MPTCP (Multipath TCP) options processing subsystem, specifically involving improper handling of malformed DSS (Data Sequence Signal) options. When a remote peer sends a malformed DSS suboption with an incorrect size followed by another DSS or MPC+Data option, the kernel fails to reset partially-written DSS fields, potentially leading to access of uninitialized data or memory inconsistency. The vulnerability affects Linux kernel versions from 5.6 onward, with fixes backported to stable releases including 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-824 (Access of Uninitialized Pointer). The MPTCP options parser in the Linux kernel does not explicitly reset DSS fields when it encounters a suboption with an unexpected/malformed size; instead, it ignores the malformed suboption but leaves partially-written field values in place. A subsequent valid DSS or MPC+Data suboption then processes these stale, potentially uninitialized fields, creating memory inconsistency. The attack vector is network-based, requires no authentication or user interaction, and can be triggered by any remote peer capable of sending crafted MPTCP packets to a listening system with MPTCP enabled (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can result in kernel-level information disclosure through access to uninitialized memory, memory corruption, or system instability (denial of service). Because the flaw resides in the kernel's network stack, impacts affect confidentiality, integrity, and availability at the system level. The attack is remotely triggerable without authentication, making any internet-exposed Linux system with MPTCP enabled a potential target (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Despite the high CVSS score, practical exploitation may be constrained by the need to send precisely crafted MPTCP packets and the requirement that the target system has MPTCP enabled and accessible (GitHub Advisory, Red Hat Bugzilla).

Update the Linux kernel to a patched version: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2+. Patches are available via the upstream stable kernel tree and through distribution-specific security updates (e.g., Red Hat). As a network-level workaround, administrators who do not require MPTCP can disable it via sysctl -w net.mptcp.enabled=0 or apply firewall rules to block MPTCP traffic at the perimeter (GitHub Advisory, Red Hat Bugzilla).