tfo-connect-bypass

Using TCP Fast Open to Bypass Syscall-based Networking Rules CVE-2026-63828/CVE-2026-72243 PoC TCP Fast Open TFO is a method of initializing and using a TCP connection where the client can send data in the initial SYN packet sent to the server. This extension to the TCP protocol was implemented f...

kernel: selinux: check connect-related permissions on TCP Fast Open

A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network...

kernel: selinux: check connect-related permissions on TCP Fast Open

A flaw was found in the Linux kernel's Security-Enhanced Linux SELinux module. When using TCP Fast Open, SELinux failed to properly check connect-related permissions. This oversight could allow a local attacker to bypass SELinux network access controls, potentially enabling unauthorized network...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In the tcpdisconnect function, the tcpsksk-fastopenrsk field was not cleared. The syzbot reported that a socket had tcpsksk-fastopenrsk in the TCPESTABLISHED state. The syzbot reused the server-side TCP Fast Open socket as a new...

SUSE CVE-2026-72243

In the Linux kernel, the following vulnerability has been resolved: selinux: check connect-related permissions on TCP Fast Open Similar to Landlock, SELinux was not updated when TCP Fast Open support was introduced to ensure connect-related permissions are checked when using TCP Fast Open. Update...

CVE-2026-80585

A flaw was found in the Linux kernel. In the Multipath TCP MPTCP Fast Open feature, a vulnerability exists where the system incorrectly marks a subflow as MPTFO even when a TCP Fast Open TFO SYN packet does not contain data. This can lead to a stale MPTFO state, potentially triggering a...

EUVD-2026-66500

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...

SUSE CVE-2026-74696

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

UBUNTU-CVE-2026-80585

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...

CVE-2026-80585

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...

CVE-2026-80585

This vulnerability affects the Linux kernel's MPTCP (Multipath TCP) Fast Open implementation. The function mptcp_fastopen_subflow_synack_set_params() incorrectly set the is_mptfo flag before verifying that SYN data had actually been queued on the child socket's receive queue. Data-less TFO SYNs (...

CVE-2026-80585: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...

Linux Distros Unpatched Vulnerability : CVE-2026-80585

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child...

CVE-2026-74696

A flaw was found in the Linux kernel's TCP Fast Open TFO implementation. During SOREUSEPORT listener migration, the system incorrectly accounts for pending TCP Fast Open requests. This can lead to a Denial of Service DoS by allowing an excessive number of Fast Open requests, potentially exhaustin...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: In tcpconnrequest, do not call reqskfastopenremove. The syzbot reported the following issue in tcpconnrequest: 0 If a listener is closed while a TFO socket is being processed in tcpconnrequest, inetcskreqskqueueadd does not set...

AZL-97110 CVE-2026-74696 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

CVE-2026-74696

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

CVE-2026-74696

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

UBUNTU-CVE-2026-74696

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...

CVE-2026-74696 tcp: fix TFO max_qlen accounting across reuseport migration

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO maxqlen accounting across reuseport migration A listener's TCPFASTOPEN maxqlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SOREUSEPORT...