External risk intelligence

Linux Kernel MPTCP Fast Open State Confusion Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-80585

This vulnerability exists in the Linux kernel MPTCP implementation regarding TCP Fast Open handling. While it involves network processing, the specific conditions required to trigger this state confusion are internal to the kernel's protocol stack management. It is not a directly exposed service or application endpoint, making public internet exposure uncommon in standard deployments.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation related to TCP Fast Open. The issue could lead to a state confusion bug under specific, albeit uncommon, conditions involving data-less Fast Open SYN packets. The primary concern is to confirm if this specific kernel behavior is relevant to your environment.

MPTCP in Linux kernel has a state confusion issue.
Confirms correct handling of specific network connection states.
Verify if your Linux kernel environment is affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to a system running the Linux kernel. This would target the Multipath TCP (MPTCP) Fast Open feature, potentially leading to a denial-of-service condition or other system instability due to state confusion within the kernel.

Network access required.
Vulnerable TCP Fast Open handling.
Kernel state confusion.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated network attacker could trigger a state-confusion bug in the Linux kernel's Multipath TCP (MPTCP) implementation by sending specially crafted data-less TCP Fast Open SYNs. This could lead to unpredictable service behavior.

Kernel MPTCP state.
Data-less TFO SYN packets.
Potential for service instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's Multipath TCP (MPTCP) implementation, specifically concerning how TCP Fast Open (TFO) subflows are managed. The primary responsibility for addressing this will likely fall to the infrastructure or platform teams managing the Linux kernel. The initial practical step is to confirm the presence of affected kernel versions and assess the business criticality and network reachability of systems running them to prioritize remediation efforts.

Linux infrastructure and platform teams own the fix.
Verify kernel versions and system exposure.
Plan MPTCP updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel MPTCP component?

Multipath TCP (MPTCP) is a protocol extension that allows a single data connection to use multiple network paths simultaneously, such as switching between Wi-Fi and cellular data without dropping the session. This specific vulnerability involves how the Linux kernel manages 'Fast Open' connections, a feature designed to speed up communication by allowing data to be sent during the initial handshake process.

What is the state confusion bug in CVE-2026-80585?

This vulnerability is a logic error where the kernel incorrectly labels a network connection as a specific type of MPTCP subflow. Because the system mistakenly believes a connection is a Fast Open subflow—even when no data was actually provided in the request—it enters an incorrect internal state. This mismatch can cause the kernel to behave unpredictably, potentially leading to system instability or denial of service.

How is this vulnerability triggered?

An attacker triggers this by sending a specially crafted TCP Fast Open request that contains no data. The bug is specifically tied to the kernel's flawed logic that labels these connections prematurely. Importantly, a standard TCP Fast Open request that successfully includes data does not trigger this confusion, nor does a standard connection that avoids the MPTCP Fast Open mechanism.

Is my system at risk from this network threat?

According to Halo Surface Signal, this vulnerability is considered unlikely to be exposed in most environments. While it is technically a network-based issue, the trigger requires specific internal kernel conditions that are not common for typical internet-facing services. You should prioritize internal assessment only if your infrastructure relies heavily on MPTCP features in your networking stack.

How should I respond to this kernel vulnerability?

Since the fix requires updating the core operating system, your primary step is to identify which of your servers or appliances are running a Linux kernel version that includes MPTCP. Coordinate with your infrastructure or platform teams to audit these systems and plan kernel updates during your next scheduled maintenance window. There is no manual configuration change that can address the underlying code flaw.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.