Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: options: reset DSS fields in case of unexpected size A remote peer could send a malformed DSS with a wrong size, followed by another DSS or MPC + Data. In this case, the first suboption will be ignored, but leaving some fields written, which could lead to inconsistency or access uninitialized data. Explicitly reset the fields that could have been modified in case of unexpected size.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:17:14.873Z",
  "pubdate": "2026-08-26T15:17:14.873Z",
  "executiveSummary": "A vulnerability exists in the Linux kernel's MPTCP implementation concerning the handling of malformed Data Sequence Signal (DSS) options. This flaw involves improper state management when a remote peer transmits a DSS suboption with an invalid size specification.\nThe vulnerability allows an attacker to induce internal state inconsistency within the kernel's MPTCP processing logic. By sending a malformed DSS followed by legitimate or specific protocol traffic, the attacker can force the kernel to retain stale or partially initialized data fields from the previously ignored suboption.\nThe impact includes potential memory corruption, information leakage, or unpredictable protocol behavior. This issue affects Linux kernel versions supporting MPTCP, posing a risk to system stability and network data integrity. No specific authentication is required, as the vulnerability is triggerable via network-level interaction with an MPTCP-enabled endpoint.\nThe primary risk is the exploitation of inconsistent state handling to potentially bypass security checks or cause kernel-level data corruption. Successful exploitation relies on the attacker's ability to craft and inject malicious MPTCP segments that deviate from expected protocol specifications.",
  "technicalDetails": "The vulnerability originates in the MPTCP options parsing logic within the Linux kernel. When the MPTCP stack processes incoming segments, it checks the length of the DSS suboption. If the size provided in the packet header does not conform to the expected length for a valid DSS, the parser enters an error-handling path.\nThe root cause is the failure of the parser to reset or zero out internal data structure fields that were partially modified before the size validation failed. When the DSS parsing logic encounters an invalid size, it effectively aborts the processing of that specific suboption but fails to clean up the state variables that were written to memory during the initial processing steps.\nThe exploitation flow is triggered when a remote attacker sends a malformed DSS segment. The kernel's parser begins writing incoming data (e.g., sequence numbers, data acknowledgments) into local variables. Upon encountering the size mismatch, the function returns an error, but the modified fields remain populated with attacker-supplied values.\nSubsequently, if the same connection receives a legitimate DSS, MPC (MP_CAPABLE), or Data segment, the protocol state machine may inadvertently utilize these 'dirty' or uninitialized fields. Because the state was not properly reset, the kernel processes subsequent traffic using stale information, leading to internal inconsistencies. This can cause the kernel to misinterpret valid subsequent packets, potentially leading to unauthorized data processing, memory access violations, or kernel-level memory disclosure.\nThis vulnerability is reachable remotely without authentication or elevated privileges, provided the target system has MPTCP enabled. The impact is primarily a violation of protocol state integrity, which serves as a primitive for further exploitation, such as disrupting existing TCP flows or triggering localized memory corruption via kernel-mode write operations based on the tainted state variables."
}