CVE-2026-80585

CVE-2026-80585 affects the Linux kernel MPTCP (Multipath TCP) fastopen subsystem. The root cause is that mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before verifying that SYN data was actually queued in the receive queue. For passive TCP Fast Open SYNs carrying a valid cookie...