CVE-2026-80587 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes. The new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this option [1], which is not the case on Linux. Here are the rules: Which options can be used together? X: mutually exclusive O: often used together C: can be used together in some cases P: could be used together but we prefer not to (optimisations) | Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC | |------|------|------|------|------|------|------|------|------| | MPC |------|------|------|------|------|------|------|------| | MPJ | X |------|------|------|------|------|------|------| | DSS | X | X |------|------|------|------|------|------| | ADD | X | X | P |------|------|------|------|------| | RM | C | C | C | P |------|------|------|------| | PRIO | X | C | C | C | C |------|------|------| | FAIL | X | X | C | X | X | X |------|------| | FC | X | X | P | X | X | X | X |------| | RST | X | X | X | X | X | X | O | O | |------|------|------|------|------|------|------|------|------| The onl
AZL-97817
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:AZL-97817
kernel
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 6.6.157.1-1
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "6.6.157.1-1"
}
]
}
],
"package": {
"name": "kernel",
"purl": "pkg:rpm/azure-linux/kernel",
"ecosystem": "Azure Linux:3"
},
"database_specific": {
"source": "https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-97817.json"
}
}
]- Related CVEs
- CVE-2026-80587
Source reference:
/upstream
Publisher severity
No explicit severity was provided.
- Event
- #68752 · Revision 1
- Added to Heist Feed
- Publisher date