CVE-2026-80587

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Multipath TCP (MPTCP) implementation where certain incoming suboptions are not properly restricted, allowing mutually exclusive suboptions to be combined. This contradicts RFC8684 and can lead to unexpected behavior because the code does not anticipate specific combinations of suboptions, particularly those that appear twice with different attributes. To address this, restrictions are applied to incoming suboptions to match the rules used for outgoing options. In cases where conflicting combinations are detected, the extra suboptions are ignored to prevent potential issues caused by buggy or malicious remote peers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.