CVE-2026-80847

CVE-2026-80847 affects the Linux kernel TCP subsystem. The root cause is a divide-by-zero in tcp_select_initial_window(), which assumes the advertised MSS (advmss) is at least 1. Route-derived advmss values can violate this assumption—either via an explicit too-small RTAX_ADVMSS or through the de...

EUVD-2026-66348

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

DEBIAN-CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916

NSD (NLnet Labs) DNS server is vulnerable to a remote TCP denial-of-service : any unauthenticated network client can crash a serve child process by throttling the TCP receive window after issuing a TCP query. By repeatedly crashing serve children, an attacker can deny all TCP service to the affec...

CVE-2026-18916

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

CVE-2026-18916 Remote TCP DoS by throttling the TCP receive window

Any remote client can crash a NSD serve child, by throttling the TCP receive window after a TCP query. By continuously crashing the serve childs, the remote client can denial all TCP service to this NSD instance...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: Networks: TLS – Avoid hanging tasks when using txlock. The syzbot reported a situation where tasks were hung. Eric explains that the adversarial receiver may keep RWIN at 0 for a long time, so we cannot guarantee progress. Thread...

libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

GHSA-HMJ8-5XMH-5573 libp2p: yamux connection DoS via oversized data frame

Summary The yamux stream multiplexer in py-libp2p does not validate incoming DATA frame lengths against the receive window before reading the frame body. Any peer that completes a standard libp2p handshake can send a single 12-byte frame claiming a 4 GB body, causing the victim's yamux read loop ...

SUSE CVE-2026-63867

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63867

A flaw was found in the Linux kernel's Multipath TCP MPTCP implementation. A race condition exists when computing the receive window, where the acknowledgment sequence number is accessed without proper locking. This can lead to inconsistencies in how the receive window is calculated and...

Linux Distros Unpatched Vulnerability : CVE-2026-63867

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different value...

EUVD-2026-45552

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

PT-2026-61184

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A TOCTOU Time-of-Check to Time-of-Use race condition exists in the MPTCP output path. The system accesses the MPTCP-level ack seq locklessly multiple times, which can lead to the use of...

Linux Distros Unpatched Vulnerability : CVE-2026-53183

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: allow subflow rcv wnd to shrink In MPTCP connection, the window field in the TCP header refers to the MPTCP-level rcvnxt and it's right edge should not...