CVE-2026-80587: Linux Kernel MPTCP Suboption Vulnerability

CVE-2026-80587 Overview

CVE-2026-80587 affects the Linux kernel's Multipath TCP (MPTCP) implementation. The vulnerability stems from insufficient validation of incoming MPTCP suboption combinations. RFC 8684 defines several MPTCP suboptions as mutually exclusive, but the kernel receive path accepted invalid or duplicate combinations. A remote peer can send crafted MPTCP options that trigger inconsistent internal state, because downstream code does not expect certain combinations to coexist. The fix applies the same restrictions used on the output side (mptcp_write_options) to incoming options, ignoring extra suboptions when a conflicting combination is received.

Critical Impact
A remote attacker can send crafted MPTCP suboption combinations over the network without authentication or user interaction, targeting kernel state handling in the MPTCP receive path.

Affected Products

Linux kernel MPTCP subsystem (upstream)
Distributions shipping vulnerable kernel versions containing the pre-patch MPTCP option parser
Stable branches referenced by the commits 099bfcbd0c16, 0e2210af4397, 6bab90729215, a04dcc784959, b6ee36152464, and dc1d8d3eb345

Discovery Timeline

2026-08-26 - CVE-2026-80587 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-80587

Vulnerability Analysis

Multipath TCP extends TCP with subflows and coordination suboptions such as MP_CAPABLE (MPC), MP_JOIN (MPJ), DSS, ADD_ADDR, RM_ADDR, MP_PRIO, MP_FAIL, MP_FASTCLOSE (FC), and MP_TCPRST. RFC 8684 declares many of these mutually exclusive. The Linux receive path did not enforce that matrix consistently, so a peer could send option combinations that internal code never expected. Certain suboptions could also appear twice with different attributes, further destabilizing option parsing.

The patch aligns receive-side validation with the existing send-side rules in mptcp_write_options. When a conflicting combination arrives, the kernel now stops processing the current suboption and ignores the extra entries. Checksum verification for options that may run in parallel with DSS is consolidated behind a new OPTIONS_MPTCP_DSS macro, ensuring the checksum path is evaluated uniformly.

Root Cause

The root cause is missing input validation on incoming MPTCP suboption combinations [CWE-20]. The parser accepted combinations that RFC 8684 forbids, including duplicate suboptions with divergent attributes and combinations such as MP_CAPABLE with MP_JOIN. Downstream code paths in subflow.c assumed these combinations were impossible, so unexpected state propagated through the MPTCP option pipeline.

Attack Vector

Exploitation is network-based and requires no authentication. An attacker who can send MPTCP-carrying TCP segments to a listener negotiating MPTCP can craft option fields containing prohibited combinations. Because MPTCP is negotiated during connection setup and maintained across subflows, both handshake and mid-session paths are reachable. A buggy or malicious peer sending, for example, MP_FASTCLOSE alongside a DSS in an unexpected form previously reached code paths that did not defend against that pairing.

No verified public exploit code is available. Refer to the upstream patches for the exact parser changes and the option-combination matrix documented in the commit message.

Detection Methods for CVE-2026-80587

Indicators of Compromise

Unexpected MPTCP option combinations captured on the wire, such as segments carrying both MP_CAPABLE and MP_JOIN, or duplicate suboptions with differing attributes.
Kernel log anomalies from MPTCP subflow handling on hosts with MPTCP enabled (net.mptcp.enabled=1).
Unexplained MPTCP subflow resets or MP_FASTCLOSE events originating from untrusted peers.

Detection Strategies

Inspect TCP option bytes for MPTCP subtype fields and flag flows containing mutually exclusive subtypes in the same segment.
Correlate MPTCP counters exposed via nstat and /proc/net/netstat (MPTcpExt.*) for spikes in option-parse rejections or subflow failures.
Baseline MPTCP usage per host so unexpected external MPTCP peers stand out for review.

Monitoring Recommendations

Enable verbose MPTCP tracepoints (mptcp:*) on representative hosts to capture option-parsing events during triage.
Forward kernel and network telemetry into a centralized data lake for retrospective hunting across the fleet.
Track kernel package versions and patch state for CVE-2026-80587 across managed Linux endpoints and servers.

How to Mitigate CVE-2026-80587

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 099bfcbd0c16, 0e2210af4397, 6bab90729215, a04dcc784959, b6ee36152464, and dc1d8d3eb345.
Update to distribution kernels that incorporate the fix as soon as vendor packages are released.
Inventory hosts with MPTCP enabled and prioritize internet-exposed listeners for patching first.

Patch Information

The fix is upstream in the Linux kernel MPTCP subsystem. It enforces the RFC 8684 suboption compatibility matrix on incoming options, matching the constraints already applied by mptcp_write_options. Conflicting or duplicate suboptions are now ignored rather than processed. See the Kernel Patch 099bfcbd0c16, Kernel Patch 0e2210af4397, Kernel Patch 6bab90729215, Kernel Patch a04dcc784959, Kernel Patch b6ee36152464, and Kernel Patch dc1d8d3eb345 for the exact code changes.

Workarounds

Disable MPTCP where it is not required by setting net.mptcp.enabled=0 via sysctl until patched kernels are deployed.
Restrict inbound MPTCP negotiation at network boundaries by filtering TCP options on untrusted ingress paths where feasible.
Limit exposure of MPTCP-enabled services to trusted network segments during the remediation window.

bash

# Temporarily disable MPTCP until patched kernels are deployed
sudo sysctl -w net.mptcp.enabled=0

# Persist the setting across reboots
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf

# Verify current state
sysctl net.mptcp.enabled