EUVD-2026-66501
GHSA-6f65-mfmh-h759
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote peer (AV:N) needs an established MPTCP session and a crafted malformed-then-valid DSS sequence (AC:H); primary impact is a limited uninitialized-data read (C:L) with possible session inconsistency (A:L), no integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mptcp: options: reset DSS fields in case of unexpected size
A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data.
Explicitly reset the fields that could have been modified in case of unexpected size.
AnalysisAI
Uninitialized-data exposure in the Linux kernel's MPTCP (Multipath TCP) option parser lets a remote peer send a malformed DSS suboption with an incorrect size, followed by a second DSS or MPC+Data, causing the first suboption to be ignored while leaving stale fields populated. The kernel then acts on inconsistent or uninitialized memory when handling the MPTCP connection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to have MPTCP enabled (CONFIG_MPTCP compiled in and net.mptcp.enabled=1) and an active MPTCP connection with the attacker as a remote peer - MPTCP is not enabled by default on many mainstream distributions, which is the primary limiting factor. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here conflict sharply and should be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote peer on the other end of an MPTCP connection (for example a malicious server the victim host connects to, or a client connecting to an MPTCP-enabled service) crafts a DSS suboption with a deliberately wrong size and immediately follows it with a second DSS or an MPC+Data option. The kernel discards the first suboption but retains its partially-written fields, then processes the connection using inconsistent or uninitialized data, potentially leaking stale kernel memory contents or destabilizing the MPTCP session. … |
| Remediation | Update to a fixed stable kernel for your branch: 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, or 7.2 or later (Vendor-released patch - the corresponding stable commits are published at git.kernel.org, e.g. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify systems with MPTCP enabled (check kernel boot parameters and netstat for MPTCP traffic) and prioritize affected servers for patching. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today