External risk intelligence

Linux Kernel MPTCP Suboption Combination Flaw.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80587

This vulnerability affects the Linux kernel's MPTCP implementation. While network-reachable, MPTCP usage is specific to certain advanced networking configurations rather than being a default, universal service. Exposure depends entirely on whether an application is configured to utilize MPTCP, making public internet reachability possible in specific environments but not common or default.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability involves how the Linux kernel handles specific combinations of Multipath TCP (MPTCP) suboptions. While MPTCP offers advanced networking capabilities, its usage is not universal, meaning the direct impact depends on whether MPTCP is actively used within the environment. The primary concern is to confirm if this specific MPTCP functionality is in use.

Incorrect MPTCP option combinations are fixed.
Confirm MPTCP usage to understand potential impact.
Assess relevance if MPTCP is actively deployed.

Attack Path

How an attacker could exploit the issue

An attacker could send specially crafted MPTCP packets to a Linux system utilizing MPTCP. The Linux kernel's MultiPath TCP (MPTCP) implementation incorrectly handles certain combinations of incoming suboptions, which are defined as mutually exclusive by RFC8684. This mishandling could lead to vulnerabilities.

Entry condition: Network exposure of MPTCP.
Trigger point: Processing of conflicting MPTCP suboptions.
Resulting risk: Potential for critical system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's MPTCP implementation could allow an attacker to send malformed MPTCP suboptions, potentially disrupting network connections when MPTCP is in use.

Network connections could be disrupted.
Malformed suboptions may be sent.
Service disruption or denial of service.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Linux kernel's MPTCP implementation requires investigation by infrastructure and platform teams. The first practical step is to identify all systems utilizing MPTCP, determine their business criticality and network exposure, and confirm the accountable owner for remediation.

Infrastructure and Platform Teams own the issue.
Verify MPTCP usage and system criticality.
Plan remediation based on risk assessment.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is MPTCP in the context of the Linux kernel?

Multipath TCP (MPTCP) is a networking protocol extension that allows a single data connection to be split across multiple physical network paths simultaneously. The Linux kernel includes an implementation of this protocol to improve efficiency and redundancy. It is an advanced feature that must be specifically configured and is not enabled as a standard default for most general-purpose Linux applications or common server workloads.

What is the vulnerability in CVE-2026-80587?

The vulnerability is an input validation error regarding how the Linux kernel manages MPTCP suboptions. The protocol standard, RFC8684, dictates that certain suboptions are mutually exclusive, but the kernel previously failed to consistently enforce these rules. By allowing prohibited combinations of these suboptions, the kernel can enter an unstable state when processing incoming network traffic, potentially leading to critical system impacts.

How does an attacker trigger this vulnerability?

An attacker triggers this flaw by sending specially crafted network packets containing conflicting or mutually exclusive MPTCP suboptions to a target system. Crucially, the vulnerability cannot be triggered if MPTCP is disabled or not in use on the host. If the system is not actively processing MPTCP traffic, it remains unaffected by these specific malformed suboption combinations.

How do I know if this CVE is relevant to my environment?

Halo Surface Signal indicates that this vulnerability is reachable over a network, but its relevance is conditional. Because MPTCP is typically used in specialized networking configurations rather than universal services, you should verify if your Linux systems are actively utilizing MPTCP features. If your environment does not use MPTCP, the risk from this specific issue is significantly lower or non-existent, regardless of internet-facing status.

What is the first step for addressing CVE-2026-80587?

The immediate priority is to conduct an internal audit of your infrastructure to identify which Linux systems have MPTCP features enabled. Once identified, evaluate the business criticality of those specific hosts and their network exposure levels. Coordinate with your platform teams to assess current configurations and plan for necessary kernel updates, ensuring that remediation efforts are prioritized based on actual MPTCP usage rather than generic system inventory.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.