CVE-2026-80586

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the fields that could have been modified in case of unexpected size.

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-25)

Published

2026-08-26

Modified

2026-10-16

Record from

the NVD, synced 2026-10-19

References

• https://git.kernel.org/stable/c/15e35fdad7a5576bf3f1c8d688877aeb5d1b506b
• https://git.kernel.org/stable/c/192878df582c51d440bf7b91a15f297f29f2b596
• https://git.kernel.org/stable/c/1fade1b2ac5b1a4948e538fae7313bea57b5ac36
• https://git.kernel.org/stable/c/26dac5c9ffb20812b475fdf253eb04fab99cff3b
• https://git.kernel.org/stable/c/27ed642a4e7e4b5df4b8522c72c457a67e052493

Check your stackJSON