926 matches found
CVE-2019-7489
This repository does not have a README...
multi_path
multipath - exploit for p0 issue 1558 CVE-2018-4241 @i41nbeer mptcpusrconnectx is the handler for the connectx syscall for the APMULTIPATH socket family. The logic of this function fails to correctly handle source and destination sockaddrs which aren't AFINET or AFINET6: root@kitploit: // verify...
CVE-2026-80588
A flaw was found in the Linux kernel's Multipath TCP mptcp implementation. Errors occurring during the receive path, before data is queued, may prevent the system from reclaiming forward-allocated memory. This can lead to an unbounded increase in memory usage under certain network conditions, suc...
CVE-2026-80587
A flaw was found in the Multipath TCP MPTCP implementation within the Linux kernel. This vulnerability arises from the kernel's handling of mutually exclusive MPTCP suboptions. A remote attacker could send specially crafted MPTCP suboptions that, when combined, are not expected by the kernel. Thi...
CVE-2026-80585
A flaw was found in the Linux kernel. In the Multipath TCP MPTCP Fast Open feature, a vulnerability exists where the system incorrectly marks a subflow as MPTFO even when a TCP Fast Open TFO SYN packet does not contain data. This can lead to a stale MPTFO state, potentially triggering a...
EUVD-2026-66502
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
EUVD-2026-66500
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...
EUVD-2026-66503
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...
EUVD-2026-66501
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...
AZL-97817 CVE-2026-80587 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
CVE-2026-80587
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
CVE-2026-80588
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...
AZL-97842 CVE-2026-80585 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...
AZL-97776 CVE-2026-80586 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...
CVE-2026-80585
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...
CVE-2026-80586
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...
UBUNTU-CVE-2026-80588
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...
CVE-2026-80587
CVE-2026-80587 affects the Linux kernel MPTCP subsystem . The vulnerability arises because the kernel failed to enforce mutual-exclusion rules on incoming MPTCP suboptions, while the same restrictions were already applied on the outgoing side via mptcp_write_options. Per RFC 8684, certain subopti...
CVE-2026-80588 mptcp: reclaim forward-allocated memory on RX path errors
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...
CVE-2026-80587 mptcp: avoid combining some incoming suboptions
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...