955 matches found
CVE-2026-80784
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...
CVE-2026-80784
CVE-2026-80784 is a memory leak in the Linux kernel MPTCP (Multipath TCP) protocol management subsystem, caused by a race condition between socket teardown (mptcp_pm_destroy()) and concurrent userspace PM ANNOUNCE handlers. mptcp_pm_destroy() drops the lock between emptying two address lists, all...
EUVD-2026-71427
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...
CVE-2026-80784 mptcp: pm: fix memory leak from alloc-during-teardown race
In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during socket teardown, dropping the lock between the two. A concurrent...
The vulnerability of the mptcp_established_options_dss() function in the net/mptcp/options.c module of the MPTCP protocol implementation in the Linux operating system allows a attacker to cause a service failure.
The vulnerability of the mptcpestablishedoptionsdss function in the net/mptcp/options.c module of the MPTCP protocol implementation in the Linux operating system is related to incorrect calculation of buffer size when processing received packets. Exploiting this vulnerability may allow a remote...
Linux Distros Unpatched Vulnerability : CVE-2026-80784
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: pm: fix memory leak from alloc-during-teardown race mptcppmdestroy empties msk-pm.annolist and msk-pm.userspacepmlocaladdrlist under msk-pm.lock during...
The vulnerability in the `net/mptcp/pm_kernel.c` component of the Linux operating system allows a hacker to cause a service failure.
The vulnerability of the net/mptcp/pmkernel.c component in the Linux operating system is related to insufficient blocking mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure...
CVE-2026-80588
A flaw was found in the Linux kernel's Multipath TCP mptcp implementation. Errors occurring during the receive path, before data is queued, may prevent the system from reclaiming forward-allocated memory. This can lead to an unbounded increase in memory usage under certain network conditions, suc...
CVE-2026-80587
A flaw was found in the Multipath TCP MPTCP implementation within the Linux kernel. This vulnerability arises from the kernel's handling of mutually exclusive MPTCP suboptions. A remote attacker could send specially crafted MPTCP suboptions that, when combined, are not expected by the kernel. Thi...
CVE-2026-80585
A flaw was found in the Linux kernel. In the Multipath TCP MPTCP Fast Open feature, a vulnerability exists where the system incorrectly marks a subflow as MPTFO even when a TCP Fast Open TFO SYN packet does not contain data. This can lead to a stale MPTFO state, potentially triggering a...
EUVD-2026-66500
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...
EUVD-2026-66502
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
EUVD-2026-66501
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...
EUVD-2026-66503
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...
SUSE CVE-2026-80587
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
AZL-97817 CVE-2026-80587 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
CVE-2026-80587
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's speciall...
CVE-2026-80588
In the Linux kernel, the following vulnerability has been resolved: mptcp: reclaim forward-allocated memory on RX path errors After commit 9db5b3cec4ec "mptcp: borrow forward memory from subflow", errors in the receive path prior to queueing skbs into the receive queue do not trigger...
AZL-97842 CVE-2026-80585 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty...
AZL-97776 CVE-2026-80586 affecting package kernel 6.6.150.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some...