TCP Fast Open Vulnerability in Linux Kernel

CVE-2026-80585

What is CVE-2026-80585?

This vulnerability in the Linux kernel arises from a flaw in the handling of TCP Fast Open (TFO) for MPTCP subflows. Specifically, it allows the acceptance of valid-cookie SYN packets even without accompanying data. This can lead to confusion in the socket state, as it may leave stale Multipath TCP Fast Open (MPTFO) states that can trigger state-validation bugs during the establishment of connections. Proper handling requires the verification of queued SYN data before marking subflows as MPTFO, ensuring accurate state management.

References