CVE-2026-80587

A flaw was found in the Multipath TCP (MPTCP) implementation within the Linux kernel. This vulnerability arises from the kernel's handling of mutually exclusive MPTCP suboptions. A remote attacker could send specially crafted MPTCP suboptions that, when combined, are not expected by the kernel. This could lead to the kernel ignoring the conflicting suboptions and stopping their processing, potentially causing unexpected network behavior or a denial of service.

A moderate impact flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation as shipped in Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS. The MPTCP input path did not validate combinations of MPTCP suboptions that RFC 8684 defines as mutually exclusive, and the code does not expect such combinations to be present. A remote attacker able to reach an MPTCP-enabled endpoint could send specially crafted packets containing conflicting or unexpected suboption combinations, causing the kernel to ignore the extra suboptions and stop processing them, which can lead to unexpected network behavior or a denial of service for the affected MPTCP connections. The impact is limited to availability: conflicting suboptions are ignored and their processing stops, and there is no evidence of memory corruption, information disclosure, or privilege escalation. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable MPTCP code is not present in those releases. The fix has been deferred for the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS streams; the residual risk is a connection-level denial of service limited to systems with MPTCP enabled and exposed to untrusted peers. Red Hat rates this flaw Moderate (CVSS 5.5, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), substantially lower than the upstream CVEORG critical rating of 9.8, because the practical effect is confined to availability of individual MPTCP connections rather than confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.