CVE-2026-80588: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-80588 is a memory leak vulnerability in the Linux kernel's MPTCP (Multipath TCP) implementation that can lead to denial of service. The flaw was introduced after commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), which caused errors in the receive path — occurring prior to queueing socket buffers (skbs) into the receive queue — to skip forward-allocated memory reclaiming. Affected kernel versions include 6.18.35 through 6.18.45 and kernel 6.19, with fixes available in 6.18.46, 7.1.10, and 7.2. It was published on August 26, 2026, with a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is improper resource management (CWE not formally assigned) in the MPTCP receive path: after commit 9db5b3cec4ec, when skbs are dropped due to errors before being queued into the receive queue, the kernel fails to call the forward-allocated memory reclaim routine. This allows the forward memory counter to grow unboundedly in pathological packet-drop scenarios. An unauthenticated remote attacker can exploit this by sending crafted or malformed MPTCP traffic that repeatedly triggers receive-path errors, causing memory to accumulate without release. The fix explicitly reclaims forward-allocated memory at the point where skbs are dropped in error conditions (Github Advisory, Linux Kernel Patch).

Successful exploitation results in unbounded growth of forward-allocated kernel memory, which can exhaust system memory and cause kernel crashes or service unavailability — a denial of service (DoS) impact. There is no confidentiality or integrity impact; the vulnerability is limited to availability. Systems running MPTCP-enabled kernels in versions 6.18.35–6.18.45 or 6.19 that are reachable over the network are at risk, particularly those exposed to untrusted network traffic (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is remotely exploitable without authentication or user interaction, lowering the barrier for potential abuse. The EPSS score is 0.0, reflecting low current exploitation probability, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

The Linux kernel project has released patches addressing this vulnerability in the following stable versions: 6.18.46, 7.1.10, and 7.2. Corresponding git commits are 473f1a5ab2abc98dd9e74b95b9c23c66c47535cc, 8277f48a06d3aa1441f6d0b6998ccc0360d30ed8, and 41b49a8b914ec7dcb03eae93fb27f3c464078644. As a workaround, administrators who do not require MPTCP can disable it (e.g., via sysctl net.mptcp.enabled=0) or restrict MPTCP connections to trusted networks using firewall rules (Github Advisory, Linux Kernel Patch).