Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: fastopen: only mark MPTFO subflows with SYN data Passive TCP Fast Open accepts a valid-cookie SYN even when it carries no data. In that case the child socket's receive queue is intentionally left empty. mptcp_fastopen_subflow_synack_set_params() set is_mptfo before checking for queued SYN data. That made data-less TFO SYNs hit a WARN and, if the warning was non-fatal, left stale MPTFO state behind. The stale flag could later trigger a state-confusion bug in check_fully_established(). Only mark the subflow as MPTFO after confirming that an SKB was queued. Return quietly when the receive queue is empty. Note that mptcp_subflow_context's is_mptfo field is now not just about subflows where the TFO was present, but about MPTFO subflow that consumed SYN data. Only having a valid cookie but not carrying data is not really "doing TFO".

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.4",
  "pubDate": "2026-08-26T15:17:14.750Z",
  "pubdate": "2026-08-26T15:17:14.750Z",
  "executiveSummary": "A state-confusion vulnerability exists within the Linux kernel MPTCP (Multipath TCP) implementation concerning TCP Fast Open (TFO) subflow handling. The vulnerability arises from improper validation of SYN data presence when marking subflows as MPTFO (Multipath TFO).\nThis flaw allows data-less TFO SYN packets to incorrectly trigger the MPTFO state, leading to a kernel warning and the persistence of stale state flags. This inconsistent internal state can subsequently trigger logic errors within the 'check_fully_established()' function, potentially leading to kernel instability or unexpected protocol behavior.\nThe vulnerability affects systems utilizing MPTCP with TFO enabled. Exploitation requires an attacker to initiate a TFO-capable connection without accompanying payload data, triggering the misconfiguration in the subflow context. While primarily a local logic error, the resulting state corruption could potentially be leveraged for denial-of-service conditions or subtle protocol bypasses depending on subsequent MPTCP subflow management.\nThe risk is categorized as moderate due to the necessity of specific network conditions and the potential for kernel warnings. Remediation requires updating the kernel to a version that restricts the 'is_mptfo' flag assignment to connections where valid SYN data is confirmed.",
  "technicalDetails": "The root cause of the vulnerability lies in the 'mptcp_fastopen_subflow_synack_set_params()' function within the MPTCP subsystem. In the original implementation, the function incorrectly assigned the 'is_mptfo' flag to the subflow context before verifying that the received TCP SYN packet actually contained payload data. Under the TCP Fast Open protocol, a passive connection can be established with a valid TFO cookie even if the SYN packet itself contains no payload.\nIn scenarios where a client sends a data-less TFO SYN, the Linux kernel infrastructure correctly leaves the child socket's receive queue empty. However, the MPTCP logic proceeded to set the 'is_mptfo' bit unconditionally. This triggered a kernel WARN (warning) because the system expects a non-empty receive queue when a subflow is designated as MPTFO. Even if the warning is non-fatal and execution continues, the 'is_mptfo' flag remains set in the 'mptcp_subflow_context' structure, effectively poisoning the subflow's state metadata.\nThe attack flow occurs as follows: 1) A remote client initiates a TCP connection using the TFO mechanism with a valid cookie but transmits zero bytes of data in the SYN segment. 2) The server-side MPTCP stack processes the SYN and enters 'mptcp_fastopen_subflow_synack_set_params()'. 3) The kernel incorrectly flags the connection as 'is_mptfo' despite the absence of data. 4) The kernel reports a warning to the system logs, signaling an internal state discrepancy. 5) Subsequent logic, specifically in 'check_fully_established()', consumes this stale 'is_mptfo' flag to make decisions regarding connection establishment, leading to a state-confusion bug.\nThis state-confusion vulnerability significantly impacts the MPTCP connection establishment process. By forcing the kernel to treat a standard TFO connection as one that 'consumed SYN data', the attacker manipulates the connection state machine. This can result in the stack incorrectly waiting for, or failing to handle, subsequent segments in a way that violates the MPTCP protocol specification. The primary post-exploitation impact involves the potential for memory corruption or system instability as the kernel manages internal state based on contradictory information, and it may allow attackers to bypass specific security checks designed for MPTFO-specific traffic flows."
}