CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data

CVE-2026-80585: mptcp: fastopen: only mark MPTFO subflows with SYN data

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fastopen: only mark MPTFO subflows with SYN data

Passive TCP Fast Open accepts a valid-cookie SYN even when it carries
no data. In that case the child socket's receive queue is intentionally
left empty.

mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking
for queued SYN data. That made data-less TFO SYNs hit a WARN and, if
the warning was non-fatal, left stale MPTFO state behind. The stale
flag could later trigger a state-confusion bug in
check_fully_established().

Only mark the subflow as MPTFO after confirming that an SKB was queued.
Return quietly when the receive queue is empty.

Note that mptcp_subflow_context's is_mptfo field is now not just about
subflows where the TFO was present, but about MPTFO subflow that
consumed SYN data. Only having a valid cookie but not carrying data is
not really "doing TFO".

The Linux kernel CVE team has assigned CVE-2026-80585 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.2 with commit 36b122baf6a8bd46b4a591f12f4ed17b22257408 and fixed in 6.6.153 with commit f75f174edc865738522e514d042cf5627f084859
	Issue introduced in 6.2 with commit 36b122baf6a8bd46b4a591f12f4ed17b22257408 and fixed in 6.12.105 with commit fca7e444c04689fe4cc6b56f2725f804a4bb1ef9
	Issue introduced in 6.2 with commit 36b122baf6a8bd46b4a591f12f4ed17b22257408 and fixed in 6.18.46 with commit 75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5
	Issue introduced in 6.2 with commit 36b122baf6a8bd46b4a591f12f4ed17b22257408 and fixed in 7.1.10 with commit 72b4a0c51a4b550d40301d60a366b429b8c8e78d
	Issue introduced in 6.2 with commit 36b122baf6a8bd46b4a591f12f4ed17b22257408 and fixed in 7.2 with commit e00b63056fb4f261455b3e5df5268a1f8ce47a87

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-80585
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/mptcp/fastopen.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f75f174edc865738522e514d042cf5627f084859
	https://git.kernel.org/stable/c/fca7e444c04689fe4cc6b56f2725f804a4bb1ef9
	https://git.kernel.org/stable/c/75e564b2ced1cc3d9a8904c7d2d2bb448fffb8b5
	https://git.kernel.org/stable/c/72b4a0c51a4b550d40301d60a366b429b8c8e78d
	https://git.kernel.org/stable/c/e00b63056fb4f261455b3e5df5268a1f8ce47a87