CVE-2026-80587

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: avoid combining some incoming suboptions

Some MPTCP suboptions are mutually exclusive according to the RFC8684,

but also because in different places, the code doesn't expect some

combinations to be present. That's specially true for suboptions that

would be present twice, but with different attributes.

The new restrictions are the same as the ones applied on the output

side, with mptcp_write_options. The same rules can be reused with a

small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks

this option [1], which is not the case on Linux. Here are the rules:

Which options can be used together?

X: mutually exclusive

O: often used together

C: can be used together in some cases

P: could be used together but we prefer not to (optimisations)

| Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC |

|------|------|------|------|------|------|------|------|------|

| MPC |--

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References