EUVD-2026-66500
GHSA-xhvw-vpqw-3xgx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Reachable over the network but requires MPTCP+passive-TFO enabled and a valid pre-obtained cookie (AC:H); described impact is a WARN/stale state, so availability-only (A:L), no confirmed confidentiality or integrity loss.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fastopen: only mark MPTFO subflows with SYN data
Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty.
mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established().
Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty.
Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".
AnalysisAI
Kernel-state confusion in the Linux MPTCP subsystem allows a remote peer to leave stale Multipath TCP Fast Open (MPTFO) state on a passively-opened socket by sending a valid-cookie TCP Fast Open SYN that carries no payload. Because mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before verifying that data was actually queued, a data-less TFO SYN triggers a WARN and, if non-fatal, leaves the subflow in an inconsistent state that can later be tripped inside check_fully_established(). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target host to have Multipath TCP enabled AND to accept passive (server-side) TCP Fast Open connections - this is not the default on many deployments. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/C:L/I:H/A:H = 9.4) overstates real-world risk and is characteristic of the automated, worst-case scoring applied to bulk Linux kernel CVEs. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has completed a prior legitimate connection to an MPTCP+TFO-enabled server (thereby obtaining a valid Fast Open cookie) sends a subsequent SYN presenting that valid cookie but carrying no data. On a vulnerable kernel this sets is_mptfo without any queued SKB, firing a WARN and leaving stale MPTFO state that can later drive a state-confusion path in check_fully_established(). … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 6.6.153, 6.12.105, 7.1.10, 6.18.46, or 7.2 (or your distribution's kernel that backports commit fca7e444c04689fe4cc6b56f2725f804a4bb1ef9 and its siblings). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems in your environment running kernel versions with MPTCP support and determine which systems actively utilize MPTCP Fast Open functionality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today