CVE-2026-80587: MPTCP Vulnerability in Linux Kernel

Linux kernel MPTCP flaw, CVSS 9.8. Improper combined suboptions handling. Verify versions and patches.

CVE-2026-80587 is a vulnerability in Linux kernel affecting MPTCP (Multipath TCP) implementation. The bug prevents proper control of combined suboptions per RFC8684, allowing combinations that the code does not expect. The flaw impacts all Linux systems with MPTCP enabled: servers, containers, cloud infrastructure leveraging multipath for network resilience.

CVSS 9.8 (critical). Published on NVD August 26, 2026. Recent signals from GitHub repositories (November 3, 2026) document available verification tools, confirming security community attention. Patch status and specific affected versions are not fully clarified in official data, but the high CVSS indicates severe and widespread impact.

Sysadmins and IT teams must immediately verify which Linux kernel versions are in use. Consult official advisories from distributions (Red Hat, Canonical, SUSE, Debian) to identify vulnerable versions and available patches. If MPTCP is enabled, prioritize kernel updates. If not critical, consider disabling MPTCP in high-risk environments as temporary mitigation.

At a glance

What: CVE-2026-80587 is a flaw in Linux kernel at MPTCP (Multipath TCP) level: lack of validation on suboptions combinations per RFC8684. The kernel accepts options that should not coexist, causing potential unexpected behaviors in the network stack.
Severity: CVSS 9.8 (critical) - declared as critical by NVD
Affected versions: Not reported in provided data. Check official advisories from Linux distributions (Red Hat, Canonical, SUSE, Debian).
Fix: Patch status not reported in provided data. Linux distributions will publish specific kernel updates; monitor their official security channels.
Status: Published NVD August 26, 2026. GitHub signals November 3, 2026 indicate verification tools available: confirms community attention.
Action: Immediately verify kernel versions in use. Consult distribution advisories to identify vulnerable versions and patches. Prioritize kernel updates. If MPTCP not critical, disable it as temporary mitigation.

Sources: NVD, CVE-2026-80587

← All articles