CVE-2026-80588

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-80588", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-26T14:34:25.770Z", "datePublished": "2026-08-26T14:37:42.685Z", "dateUpdated": "2026-10-16T19:26:28.920Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:02:09.335Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: reclaim forward-allocated memory on RX path errors\n\nAfter commit 9db5b3cec4ec (\"mptcp: borrow forward memory from subflow\"),\nerrors in the receive path prior to queueing skbs into the receive\nqueue do not trigger forward-allocated memory reclaiming.\n\nPrevent forward memory from growing unboundedly in pathological drop\nscenarios by explicitly reclaiming memory when skbs are dropped."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote TCP/MPTCP peers reach the bug on the established-connection RX datapath (tcp_rcv_established \u2192 subflow_data_ready \u2192 mptcp_data_ready \u2192 __mptcp_move_skbs_from_subflow \u2192 __mptcp_move_skb \u2192 mptcp_drop) when duplicate or out-of-window mapped data is dropped before skb_set_owner_r().\nAC:L - The attacker fully controls subflow packet contents and ordering on their MPTCP connection and can deterministically trigger drops (duplicate map_seq, OoO beyond rcv_wnd) on every crafted segment without races, rare sysctl state, or uncontrollable memory layout.\nPR:N - No local account or kernel capability is required on the victim; any remote peer that completes the TCP/MPTCP handshake on an IPPROTO_MPTCP socket (Android clients, MPTCP-enabled servers, curl --mptcp) can flood pathological RX drops without target credentials.\nUI:N - Exploitation needs only attacker-generated MPTCP/TCP traffic on an existing or attacker-initiated connection; no victim mount, file open, click, or other cooperative user action beyond normal network stack processing.\nS:U - Impact is unbounded sk_forward_alloc growth and kernel memory exhaustion on the affected host; it does not cross VM, container, IOMMU, or sandbox boundaries to another security authority.\nC:N - This is a forward-memory accounting leak on skb drop after mptcp_borrow_fwdmem(); skb data is freed and no use-after-free, out-of-bounds read, or other memory-corruption primitive exposes kernel contents to the attacker.\nI:N - The flaw only fails to reclaim borrowed forward allocation when dropping skbs; it does not corrupt, overwrite, or modify attacker-chosen memory and provides no write or code-execution primitive.\nA:H - Each pre-queue drop leaks roughly skb->truesize forward memory while bypassing the removed sk_rmem_schedule guard, so a remote peer can repeatedly trigger unbounded per-connection kernel memory growth and OOM denial of service, matching CNA precedent for repeatable network skb/memory leaks."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c"], "versions": [{"version": "a84164847b1e0a106ebc46821e5d2f9b775c9dc8", "lessThan": "473f1a5ab2abc98dd9e74b95b9c23c66c47535cc", "status": "affected", "versionType": "git"}, {"version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754", "lessThan": "8277f48a06d3aa1441f6d0b6998ccc0360d30ed8", "status": "affected", "versionType": "git"}, {"version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754", "lessThan": "41b49a8b914ec7dcb03eae93fb27f3c464078644", "status": "affected", "versionType": "git"}, {"version": "6.18.35", "lessThan": "6.18.46", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/protocol.c"], "versions": [{"version": "6.19", "status": "affected"}, {"version": "0", "lessThan": "6.19", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.46", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.10", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.35", "versionEndExcluding": "6.18.46"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.1.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/473f1a5ab2abc98dd9e74b95b9c23c66c47535cc"}, {"url": "https://git.kernel.org/stable/c/8277f48a06d3aa1441f6d0b6998ccc0360d30ed8"}, {"url": "https://git.kernel.org/stable/c/41b49a8b914ec7dcb03eae93fb27f3c464078644"}], "title": "mptcp: reclaim forward-allocated memory on RX path errors", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:18:06.349693Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:28.920Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-80588", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:18:06.349693Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:18:07.249Z"}}], "cna": {"title": "mptcp: reclaim forward-allocated memory on RX path errors", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - Remote TCP/MPTCP peers reach the bug on the established-connection RX datapath (tcp_rcv_established \u2192 subflow_data_ready \u2192 mptcp_data_ready \u2192 __mptcp_move_skbs_from_subflow \u2192 __mptcp_move_skb \u2192 mptcp_drop) when duplicate or out-of-window mapped data is dropped before skb_set_owner_r().\nAC:L - The attacker fully controls subflow packet contents and ordering on their MPTCP connection and can deterministically trigger drops (duplicate map_seq, OoO beyond rcv_wnd) on every crafted segment without races, rare sysctl state, or uncontrollable memory layout.\nPR:N - No local account or kernel capability is required on the victim; any remote peer that completes the TCP/MPTCP handshake on an IPPROTO_MPTCP socket (Android clients, MPTCP-enabled servers, curl --mptcp) can flood pathological RX drops without target credentials.\nUI:N - Exploitation needs only attacker-generated MPTCP/TCP traffic on an existing or attacker-initiated connection; no victim mount, file open, click, or other cooperative user action beyond normal network stack processing.\nS:U - Impact is unbounded sk_forward_alloc growth and kernel memory exhaustion on the affected host; it does not cross VM, container, IOMMU, or sandbox boundaries to another security authority.\nC:N - This is a forward-memory accounting leak on skb drop after mptcp_borrow_fwdmem(); skb data is freed and no use-after-free, out-of-bounds read, or other memory-corruption primitive exposes kernel contents to the attacker.\nI:N - The flaw only fails to reclaim borrowed forward allocation when dropping skbs; it does not corrupt, overwrite, or modify attacker-chosen memory and provides no write or code-execution primitive.\nA:H - Each pre-queue drop leaks roughly skb->truesize forward memory while bypassing the removed sk_rmem_schedule guard, so a remote peer can repeatedly trigger unbounded per-connection kernel memory growth and OOM denial of service, matching CNA precedent for repeatable network skb/memory leaks."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a84164847b1e0a106ebc46821e5d2f9b775c9dc8", "lessThan": "473f1a5ab2abc98dd9e74b95b9c23c66c47535cc", "versionType": "git"}, {"status": "affected", "version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754", "lessThan": "8277f48a06d3aa1441f6d0b6998ccc0360d30ed8", "versionType": "git"}, {"status": "affected", "version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754", "lessThan": "41b49a8b914ec7dcb03eae93fb27f3c464078644", "versionType": "git"}, {"status": "affected", "version": "6.18.35", "lessThan": "6.18.46", "versionType": "semver"}], "programFiles": ["net/mptcp/protocol.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"status": "unaffected", "version": "0", "lessThan": "6.19", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.46", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.10", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mptcp/protocol.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/473f1a5ab2abc98dd9e74b95b9c23c66c47535cc"}, {"url": "https://git.kernel.org/stable/c/8277f48a06d3aa1441f6d0b6998ccc0360d30ed8"}, {"url": "https://git.kernel.org/stable/c/41b49a8b914ec7dcb03eae93fb27f3c464078644"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: reclaim forward-allocated memory on RX path errors\n\nAfter commit 9db5b3cec4ec (\"mptcp: borrow forward memory from subflow\"),\nerrors in the receive path prior to queueing skbs into the receive\nqueue do not trigger forward-allocated memory reclaiming.\n\nPrevent forward memory from growing unboundedly in pathological drop\nscenarios by explicitly reclaiming memory when skbs are dropped."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.46", "versionStartIncluding": "6.18.35"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.10", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-27T05:02:09.335Z"}}}, "cveMetadata": {"cveId": "CVE-2026-80588", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:26:28.920Z", "dateReserved": "2026-08-26T14:34:25.770Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-26T14:37:42.685Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "473f1a5ab2abc98dd9e74b95b9c23c66c47535cc", "status": "affected", "version": "a84164847b1e0a106ebc46821e5d2f9b775c9dc8", "versionType": "git"}, {"lessThan": "8277f48a06d3aa1441f6d0b6998ccc0360d30ed8", "status": "affected", "version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754", "versionType": "git"}, {"lessThan": "41b49a8b914ec7dcb03eae93fb27f3c464078644", "status": "affected", "version": "9db5b3cec4ec1c0cd3239689f5c8653d691a1754", "versionType": "git"}, {"lessThan": "6.18.46", "status": "affected", "version": "6.18.35", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mptcp/protocol.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.19"}, {"lessThan": "6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.46", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: reclaim forward-allocated memory on RX path errors\n\nAfter commit 9db5b3cec4ec (\"mptcp: borrow forward memory from subflow\"),\nerrors in the receive path prior to queueing skbs into the receive\nqueue do not trigger forward-allocated memory reclaiming.\n\nPrevent forward memory from growing unboundedly in pathological drop\nscenarios by explicitly reclaiming memory when skbs are dropped."}], "id": "CVE-2026-80588", "lastModified": "2026-10-16T20:18:02.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-80588", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:18:06.349693Z", "version": "2.0.3"}}]}, "published": "2026-08-26T15:17:15.180", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/41b49a8b914ec7dcb03eae93fb27f3c464078644"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/473f1a5ab2abc98dd9e74b95b9c23c66c47535cc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8277f48a06d3aa1441f6d0b6998ccc0360d30ed8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: mptcp: reclaim forward-allocated memory on RX path errors", "id": "2524510", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524510"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-772", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nmptcp: reclaim forward-allocated memory on RX path errors\nAfter commit 9db5b3cec4ec (\"mptcp: borrow forward memory from subflow\"),\nerrors in the receive path prior to queueing skbs into the receive\nqueue do not trigger forward-allocated memory reclaiming.\nPrevent forward memory from growing unboundedly in pathological drop\nscenarios by explicitly reclaiming memory when skbs are dropped.", "A flaw was found in the Linux kernel's Multipath TCP (mptcp) implementation. Errors occurring during the receive path, before data is queued, may prevent the system from reclaiming forward-allocated memory. This can lead to an unbounded increase in memory usage under certain network conditions, such as high packet loss. A remote attacker could exploit this vulnerability to cause a Denial of Service (DoS) by exhausting available system memory."], "name": "CVE-2026-80588", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-26T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-80588\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-80588\nhttps://lore.kernel.org/linux-cve-announce/2026082616-CVE-2026-80588-cd6f@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[a84164847b1e0a106ebc46821e5d2f9b775c9dc8,473f1a5ab2abc98dd9e74b95b9c23c66c47535cc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9db5b3cec4ec1c0cd3239689f5c8653d691a1754,8277f48a06d3aa1441f6d0b6998ccc0360d30ed8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[9db5b3cec4ec1c0cd3239689f5c8653d691a1754,41b49a8b914ec7dcb03eae93fb27f3c464078644)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.35,6.18.46)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.46,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.10,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-26T17:00:04.694101+00:00", "updated": "2026-08-28T18:30:08.313754+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}