Cloudanix VulnDB

CVE-2026-80847

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's handling of network connection sizes could let attackers crash affected computers by sending specially crafted network settings.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Divide-by-zero in tcp_select_initial_window when route-derived advmss drops below TCP_MIN_MSS, reachable via explicit RTAX_ADVMSS or default advmss path driven by MTU and min_adv_mss.

Why it matters to the business

Linux-based systems may experience kernel crashes or denial of service, leading to unplanned downtime and service disruption, especially on network-facing servers.

How an attack unfolds

An attacker crafts network routes or MTU settings that force an advmss value smaller than one, triggering the divide-by-zero during TCP initial window selection when a connection is established.

How to fix it

Upgrade the Linux kernel to a version containing the tcp_dst_advmss helper that clamps advmss to TCP_MIN_MSS before use in TCP paths.

How to confirm the fix worked

Verify the presence of the tcp_dst_advmss clamping logic in the kernel source or confirm the patched kernel version is running; test route configurations that previously produced sub-TCP_MIN_MSS advmss values.

Typical attack path

  1. Configure malicious route metrics or MTU values on a path to the target
  2. Trigger TCP connection initiation that invokes tcp_select_initial_window
  3. Cause kernel division by zero resulting in panic or crash

How to detect it

Search kernel logs and crash dumps for oops or panic messages referencing tcp_select_initial_window or division by zero during TCP window calculation; inspect recent route or MTU changes preceding the event.

What your security team should do

  • Apply the kernel patch or upgrade to a fixed release as soon as available
  • Monitor kernel logs for divide-by-zero oops in TCP stack functions
  • Restrict untrusted route advertisement or MTU manipulation where feasible

The record

In the Linux kernel, the following vulnerability has been resolved: tcp: clamp route advmss to TCP_MIN_MSS tcp_select_initial_window() assumes that callers never pass an MSS smaller than 1, but route-derived advmss values can violate that assumption. A too-small explicit RTAX_ADVMSS is one way to get there, but it is not the only one. The same divide-by-zero can also be reached through the "default advmss" path when RTAX_ADVMSS is left at 0 and the effective advmss is later driven down by route MTU and min_adv_mss. Introduce a tcp_dst_advmss() helper that clamps route advmss to TCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that derive advmss from dst metrics. This keeps the effective MSS from dropping to zero before tcp_select_initial_window() rounds the receive window.

Affected packages

Ecosystem Package Introduced Fixed