CVE-2026-80587: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-80587 is a memory corruption vulnerability in the Linux kernel's MPTCP (Multipath TCP) subsystem caused by insufficient validation of incoming MPTCP suboption combinations. The kernel fails to enforce RFC8684 restrictions that prohibit simultaneous use of mutually exclusive suboptions (e.g., MPC with MPJ/DSS/ADD/PRIO), allowing crafted packets to trigger unexpected code paths and memory corruption. The vulnerability affects Linux kernel versions from 5.6 through multiple stable branches, with fixes available in versions 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2+. It carries a CVSS v3.1 base score of 9.8 (Critical) (GitHub Advisory).

The root cause is improper input validation (no CWE formally assigned) in the Linux kernel's MPTCP suboption parsing logic, which lacks the same mutual-exclusivity enforcement applied on the output side via mptcp_write_options. When an incoming MPTCP packet contains incompatible suboption combinations — such as MPC paired with MPJ, DSS, ADD, or PRIO — the kernel processes them without rejecting the invalid state, leading to memory corruption because downstream code paths do not anticipate these combinations. The fix introduces validation rules mirroring the output-side restrictions, ignoring conflicting suboptions rather than processing them. Patches are tracked across multiple stable kernel commits including dc1d8d3eb345, 099bfcbd0c16, a04dcc784959, 6bab90729215, and b6ee361524641 (GitHub Advisory).

Successful exploitation allows an unauthenticated remote attacker to trigger memory corruption in the Linux kernel's MPTCP subsystem, potentially leading to arbitrary code execution with kernel privileges. Full kernel compromise would grant an attacker complete control over the affected system, including access to all data (confidentiality impact: High), ability to modify system state and data (integrity impact: High), and the potential to crash or destabilize the system (availability impact: High). Given the network-accessible attack vector and kernel-level privilege escalation potential, exploitation could facilitate lateral movement within a network or serve as a foothold for deeper infrastructure compromise (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The vulnerability is remotely exploitable with no authentication or user interaction required, which significantly lowers the barrier for exploitation if a PoC were to emerge. No threat actor attribution has been reported, and the CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. EPSS score data is not yet available for this recently disclosed CVE.

Apply the latest Linux kernel patches that enforce proper MPTCP suboption combination validation. Fixed versions include 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2 (mainline). Administrators unable to patch immediately should consider disabling MPTCP functionality via sysctl -w net.mptcp.enabled=0 to eliminate the attack surface. Additionally, network-level filtering of malformed MPTCP packets at perimeter firewalls or IDS/IPS systems can provide a temporary compensating control (GitHub Advisory).