Vulnerability in Linux Kernel Affecting Multipath TCP Implementation

CVE-2026-80587

What is CVE-2026-80587?

A vulnerability in the Linux kernel's multipath TCP (MPTCP) implementation has been identified that arises from improper handling of mutually exclusive suboptions as per RFC8684. This vulnerability allows certain suboption combinations to be processed incorrectly during TCP communication, which may lead to unexpected behavior and could potentially be exploited if an attacker sends crafted packets. Restrictions have been enforced in the code to prevent the combination of incompatible suboptions, ensuring that only valid options can be utilized together. The patch aims to enhance the robustness of MPTCP by handling erroneous combinations gracefully, reflecting an ongoing effort to maintain security in network protocols.

References