---
id: CVE-2026-80847
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: clamp route advmss to TCP_MIN_MSS

  tcp_select_initial_window() assumes that callers never pass an MSS
  smaller than 1, but route-derived advmss values can violate t…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: clamp route advmss to TCP_MIN_MSS

  tcp_select_initial_window() assumes that callers never pass an MSS
  smaller than 1, but route-derived advmss values can violate t…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    eaf4af9bd6975c2eff8d48820937c83032d968dc
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    cfb44c6028e6f979720315e0772bbd0d4d33ed61
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    6b8c20bf61924dfc38fefb145c9f7406d73fae53
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    31cf2349361902769dc323e4dbf4b449795ec288
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1
  - Linux 2.6.12
published: '2026-09-04'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:20.933'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80847'
references:
  - url: 'https://git.kernel.org/stable/c/31cf2349361902769dc323e4dbf4b449795ec288'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6b8c20bf61924dfc38fefb145c9f7406d73fae53'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cfb44c6028e6f979720315e0772bbd0d4d33ed61'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eaf4af9bd6975c2eff8d48820937c83032d968dc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00209
epssPercentile: 0.09782
ingestedAt: '2026-09-11T16:45:47.925Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: clamp route advmss to TCP_MIN_MSS

tcp_select_initial_window() assumes that callers never pass an MSS
smaller than 1, but route-derived advmss values can violate that
assumption.

A too-small explicit RTAX_ADVMSS is one way to get there, but it is not
the only one. The same divide-by-zero can also be reached through the
"default advmss" path when RTAX_ADVMSS is left at 0 and the effective
advmss is later driven down by route MTU and min_adv_mss.

Introduce a tcp_dst_advmss() helper that clamps route advmss to
TCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that
derive advmss from dst metrics. This keeps the effective MSS from
dropping to zero before tcp_select_initial_window() rounds the receive
window.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.