CVE-2026-80588 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
mptcp: reclaim forward-allocated memory on RX path errors
After commit 9db5b3cec4ec ("mptcp: borrow forward memory from subflow"), errors in the receive path prior to queueing skbs into the receive queue do not trigger forward-allocated memory reclaiming.
Prevent forward memory from growing unboundedly in pathological drop scenarios by explicitly reclaiming memory when skbs are dropped.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/26/2026
The Linux kernel's Multipath TCP implementation contains a resource management flaw within its receive path processing logic that can lead to unbounded memory consumption under specific error conditions. This vulnerability stems from an optimization introduced in commit 9db5b3cec4ec, which allows the MPTCP layer to borrow forward-allocated memory from underlying subflows to improve throughput and reduce latency during packet reception. While this mechanism enhances performance by pre-allocating buffers for incoming data streams, it introduces a critical oversight regarding error handling paths that occur before packets are successfully queued into the socket receive buffer.
The technical flaw manifests when errors arise in the receive path prior to the final queueing of sk_buff structures. In these scenarios, the kernel fails to trigger the necessary memory reclaim operations for the forward-allocated resources previously borrowed from subflows. Consequently, if a packet is dropped due to an error condition such as buffer exhaustion, checksum failure, or protocol state inconsistency, the associated pre-allocated memory remains reserved and unreleased. This creates a scenario where system memory usage grows linearly with each failed reception attempt without corresponding deallocation, effectively creating a resource leak within the kernel space.
From an operational perspective, this vulnerability poses a significant risk of denial-of-service through resource exhaustion. An attacker capable of inducing repeated receive path errors can systematically consume available kernel memory on the affected host. As forward-allocated memory accumulates unboundedly, it may eventually exhaust system resources, leading to degraded network performance for legitimate traffic or complete system instability due to out-of-memory conditions in critical subsystems. This is particularly dangerous in high-throughput environments where rapid packet processing occurs and transient errors might be frequent enough to trigger the leak repeatedly over time.
The vulnerability aligns with CWE-401, which describes a missing release of memory after effective usage, specifically within the context of kernel-level resource management failures. It also relates to CWE-770 regarding allocation of resources without limits, as the forward-allocation mechanism lacks sufficient bounds checking during error recovery paths. In terms of adversarial tactics, this flaw can be exploited via ATT&CK technique T1496, Resource Hijacking, where an attacker consumes computational or memory resources to degrade service availability for other processes or users on the same system.
Mitigation strategies primarily involve applying kernel patches that explicitly reclaim forward-allocated memory when sk_buffs are dropped due to errors in the receive path. System administrators should ensure their Linux kernels are updated with versions containing fixes for this specific MPTCP regression. Additionally, monitoring tools can be configured to track unusual spikes in kernel memory allocation patterns associated with network interfaces utilizing Multipath TCP. Implementing strict rate limiting on incoming connections and configuring appropriate socket buffer limits can further reduce the attack surface by capping the maximum amount of forward-allocated memory that any single connection or flow can consume during error scenarios.