External risk intelligence

Linux Kernel MPTCP Malformed DSS Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80586

The vulnerability affects the Linux kernel's MPTCP implementation. While reachable via network, MPTCP is a transport-layer protocol feature rather than a standard public-facing service. Exploitation requires the host to actively utilize MPTCP, limiting exposure to systems specifically configured to use this protocol for multi-path connection optimization.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel's MPTCP implementation could allow a remote peer to send malformed data, potentially leading to inconsistencies or access to uninitialized data. While classified as critical, its impact is limited to systems actively using MPTCP.

Malformed data could cause system inconsistencies.
Confirms MPTCP relevance and exposure.
Assess MPTCP usage for potential impact.

Attack Path

How an attacker could exploit the issue

A remote attacker can send specially crafted network data to a Linux system using the MultiPath TCP (MPTCP) feature. If the system processes this malformed data incorrectly, it can lead to data corruption or the use of uninitialized memory, potentially impacting system stability and security.

No authentication or user interaction needed.
Malformed MPTCP data triggers vulnerability.
Potential for system instability and data compromise.

Live Threat

Current exploitation, exposure, and threat context

A remote attacker could send specially crafted network traffic that exploits a flaw in the Linux kernel's MPTCP implementation. This could lead to system instability or the exposure of uninitialized data within the kernel.

Kernel data could be exposed.
Malformed network packets may trigger the issue.
System instability or data leakage may occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's MPTCP implementation is affected by a vulnerability that could lead to data inconsistency or access to uninitialized data if a remote peer sends a malformed DSS. This impacts systems utilizing MPTCP for connection optimization. The first practical step is to identify Linux systems using MPTCP, assess their exposure and business criticality, and then coordinate with the accountable team for remediation planning.

Owner: Infrastructure or Platform Teams.
Verify: MPTCP usage and exposure.
Action: Plan and execute remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel MPTCP component?

MultiPath TCP (MPTCP) is a protocol extension in the Linux kernel that allows a single data connection to be split across multiple network paths simultaneously. It is typically used in environments requiring high availability, network resilience, or aggregated bandwidth, such as mobile devices switching between Wi-Fi and cellular data or specialized data center traffic optimization.

What is the nature of the CVE-2026-80586 vulnerability?

This flaw involves improper input validation in how the kernel processes MPTCP data options. When a remote peer sends a Data Sequence Signal (DSS) with an unexpected size, the kernel may fail to correctly reset its internal state. This can lead to memory inconsistencies or the potential exposure of uninitialized data, which occurs because the system incorrectly persists fields from previous operations.

How is this MPTCP vulnerability triggered?

An attacker triggers this issue by sending specifically malformed MPTCP network packets to a target host. It is important to note that simply running a Linux kernel with MPTCP support is not sufficient for exploitation; the kernel must be actively engaged in an MPTCP-based connection for the malformed DSS to be processed and the vulnerability to be triggered.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates the vulnerability is reachable over the network, but risk is largely confined to systems where MPTCP is intentionally enabled and in use. Since MPTCP is a specialized transport-layer feature rather than a common public-facing service, only systems specifically configured for multi-path connection optimization are generally affected.

How do I respond to this Linux kernel threat?

The priority is to determine if your infrastructure actively utilizes MPTCP. Work with platform or infrastructure teams to audit system configurations for MPTCP usage. Once you identify systems running the protocol, assess their network exposure and business criticality, then coordinate with the appropriate technical teams to plan for and apply the necessary kernel updates.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.