Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid combining some incoming suboptions Some MPTCP suboptions are mutually exclusive according to the RFC8684, but also because in different places, the code doesn't expect some combinations to be present. That's specially true for suboptions that would be present twice, but with different attributes. The new restrictions are the same as the ones applied on the output side, with mptcp_write_options. The same rules can be reused with a small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks this option [1], which is not the case on Linux. Here are the rules: Which options can be used together? X: mutually exclusive O: often used together C: can be used together in some cases P: could be used together but we prefer not to (optimisations) | Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC | |------|------|------|------|------|------|------|------|------| | MPC |------|------|------|------|------|------|------|------| | MPJ | X |------|------|------|------|------|------|------| | DSS | X | X |------|------|------|------|------|------| | ADD | X | X | P |------|------|------|------|------| | RM | C | C | C | P |------|------|------|------| | PRIO | X | C | C | C | C |------|------|------| | FAIL | X | X | C | X | X | X |------|------| | FC | X | X | P | X | X | X | X |------| | RST | X | X | X | X | X | X | O | O | |------|------|------|------|------|------|------|------|------| The only difference is with the 'P': another stack could send and ADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be allowed. A few points of attention: - In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is no reason to add it with a SYN. Note that even with a 4th ACK, it doesn't seem to be useful, except when IDs are known in advance via another channel. Better not to break that. - Now, combining both an MP_CAPABLE and an MP_JOIN will no longer result to a reject of the two options, but only the second suboption is ignored. That seems OK to do that for this unexpected error. At least now all inconsistent combinations are handled the same way. This could change later in next. This also means the explicit checks for having both MPC + MPJ in subflow.c will now be unreachable. That's fine, they will be removed in a follow-up patch. - In case of conflicting combinations, the extra suboption(s) is/are ignored: having such combinations either means the remote peer is buggy, or is evil. The simplest action is then taken in this case: stop processing the current suboption. - In mp_opt->suboptions, there is also a bit reserved to the checksum, which can be used in an MP_CAPABLE and a DSS. Each time a DSS option can be used in parallel with another option, the checksum can be set, so the verification is combined into a new OPTIONS_MPTCP_DSS macro. - An MP_CAPABLE ACK can carry a Data-Level Length, and an optional Checksum: they are the same as the ones found in a DSS, because a DSS cannot be used in parallel to an MP_CAPABLE. Similarly, even if there is room, a DSS cannot be used with an MP_JOIN.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-26T15:17:15.017Z",
  "pubdate": "2026-08-26T15:17:15.017Z",
  "executiveSummary": "The Linux kernel MPTCP (Multi-Path TCP) implementation was susceptible to improper handling of mutually exclusive protocol suboptions, leading to potential security risks and protocol inconsistencies.\nThis vulnerability involves the insufficient validation of incoming MPTCP suboption combinations, which are strictly regulated by RFC8684.\nAn attacker can exploit this by crafting malicious packets containing illegal or conflicting combinations of suboptions, such as combining MP_CAPABLE with MP_JOIN or other restricted pairs.\nThe vulnerability resides within the MPTCP option parsing logic. Failure to reject or safely handle these combinations can lead to unstable kernel state, potential memory corruption, or unexpected protocol behavior.\nThe risk is primarily related to protocol robustness and state management. Attackers can leverage this to trigger error handling paths, induce kernel-level logging, or potentially disrupt active MPTCP connections.\nRemediation involves implementing a comprehensive validation matrix to enforce RFC8684 compliance, ensuring that conflicting suboptions are either rejected or ignored in a controlled manner to prevent unauthorized state transitions or exploitable memory conditions.",
  "technicalDetails": "The root cause of this vulnerability lies in the lack of rigid enforcement of suboption mutual exclusivity during the parsing of incoming MPTCP headers. RFC8684 explicitly defines which MPTCP suboptions are permitted to coexist within a single TCP segment.\nIn the affected kernel implementation, several suboption combinations were not explicitly blocked or sanitized, allowing combinations that the internal code was not designed to process simultaneously. This inconsistency created a gap between the expected packet structures and the actual logical handling within the MPTCP stack.\nSpecifically, the Linux kernel did not adequately restrict combinations such as MP_CAPABLE (MPC) and MP_JOIN (MPJ), or combinations involving DSS (Data Sequence Signal) with other control options that violate protocol constraints. Because these suboptions represent distinct functional states (e.g., connection initiation, path joining, data flow), their concurrent processing caused the kernel's internal suboption bitmask to reach undefined or logically impossible states.\nThe attack flow involves an adversary sending a specially crafted TCP packet to a target machine with an active MPTCP-capable socket. The packet payload includes an MPTCP option field containing illegal combinations, such as an MPC together with an MPJ. Upon receipt, the kernel's MPTCP parser iterates through the options. Previously, the parser might attempt to process both conflicting options, leading to potential buffer mismanagement or invalid state transitions in the connection management layer.\nBy systematically triggering these inconsistent states, an attacker could force the kernel into error-prone code paths. In some scenarios, this might lead to premature termination of connections, state desynchronization between endpoints, or, in the worst case, memory safety violations where the code assumes one specific suboption state while another has already been partially processed. The fix introduces a structured matrix approach that mirrors the output-side logic (mptcp_write_options), ensuring that if an invalid combination is detected, the kernel proactively stops processing the conflicting suboption, effectively dropping the malformed portion of the packet rather than attempting to reconcile the illegal input.\nThe vulnerability highlights a critical failure in enforcing protocol-level integrity at the boundary of the kernel's network stack. Without these restrictions, an attacker could probe the limits of the kernel's packet processing logic and potentially facilitate denial-of-service (DoS) conditions by inducing kernel panics or connection instability."
}