Executive brief
The Linux kernel's MPTCP (Multipath TCP) network protocol handler contains a vulnerability in how it processes malformed Data Sequence Signal (DSS) options in TCP packets. A remote attacker sending specially crafted packets could cause the kernel to leave uninitialized data in memory fields, potentially leaking sensitive kernel information or causing unpredictable behavior in TCP connections.
Technical details
The vulnerability exists in the mptcp_parse_option() function within net/mptcp/options.c. When a malformed DSS option with an unexpected size is received, the function would reject the option but fail to reset internal state fields (dsn64, use_map, ack64, use_ack, data_fin). A remote peer can exploit this by sending a malformed DSS followed by another DSS or MPC+Data option, leaving previously-written fields in an inconsistent state or exposing uninitialized data. The fix explicitly resets these fields when an unexpected size is detected. The vulnerability is reachable over the network from any remote peer capable of sending TCP packets with MPTCP options, requiring no prior authentication.
Affected products
- Linux Linux kernel multiple versions; fix released in upstream commit 35772b4981f38ba8059372cde8753e8e477e98ec
Timeline
- 2026-08-26: disclosed
- 2026-08-03: patched: Patch commit 35772b4981f38ba8059372cde8753e8e477e98ec authored, merged into stable trees by 2026-08-23