Executive brief
The Linux kernel contains a vulnerability in how it handles incoming MPTCP (Multipath TCP) protocol options used for advanced network communication. The kernel failed to properly validate and restrict combinations of these options according to protocol specifications, potentially allowing malformed packets to trigger unexpected behavior or system crashes.
Technical details
This vulnerability exists in the Linux kernel's MPTCP suboption processing logic, where the code did not enforce RFC8684-mandated mutual exclusivity rules for incoming suboptions. Specifically, certain suboption combinations that should not occur together were not rejected, potentially causing code paths that assume such combinations are impossible to behave unexpectedly. The fix introduces validation rules matching RFC8684 specifications, treating conflicting suboptions by ignoring the extra option(s) rather than crashing. The vulnerability is reachable from network-attached systems sending specially crafted MPTCP packets, requiring no authentication or local access.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-08-26: disclosed
- 2026-08-26: patched: Fix applied to kernel MPTCP suboption validation logic