CVE-2026-80587 Combinación indebida de subopciones entrantes en mptcp del kernel Linux
En el kernel Linux se resolvió una vulnerabilidad en mptcp: algunas subopciones MPTCP entrantes mutuamente excluyentes según la RFC8684 podían combinarse, algo que el código no espera en distintos puntos. Se aplican las mismas restricciones que del lado de salida con mptcp_write_options, con un pequeño ajuste para permitir MP_FASTCLOSE junto con DSS.
CVSS 3.1
- Probabilidad de explotación · EPSS del 09/110,5 % · percentil 44
- Explotada activamenteNo confirmada
- Exploit públicoSí, 1
Afectados
Linux
desde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de 0e2210af439755a2af352eea4178261dcf61742edesde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de d1bce616636c1c42649966677973490a510055c4desde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de dc1d8d3eb345c616fbe922a010fa391c72c54d52desde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de 099bfcbd0c16ae9b50aba2a1bea033e63f895da7desde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de a04dcc784959e4702048785d87e0d029bd2fbdcbdesde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de 6bab907292155513af397a12ccb488acbfc30d79desde eda7acddf8080bb2d022a8d4b8b2345eb80c63ec hasta antes de b6ee361524641f57b2e2363f7737f20e17f67827
Linux
5.6
Qué hacer
- Verificá si usás Linux y en qué versión.
- Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
- Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.
- Priorizá la corrección: hay código de explotación público.
Exploits públicos
Código publicado por terceros. Puede ser malicioso: revisalo solo en un entorno aislado.
Calculadora CVSS
CVSS 3.1 · 9.8 CRÍTICA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Vector de ataqueRed
- Complejidad del ataqueBaja
- Privilegios requeridosNinguno
- Interacción del usuarioNinguna
- AlcanceSin cambio
- ConfidencialidadAlta
- IntegridadAlta
- DisponibilidadAlta
Descripción original
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid combining some incoming suboptions
Some MPTCP suboptions are mutually exclusive according to the RFC8684,
but also because in different places, the code doesn't expect some
combinations to be present. That's specially true for suboptions that
would be present twice, but with different attributes.
The new restrictions are the same as the ones applied on the output
side, with mptcp_write_options. The same rules can be reused with a
small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks
this option [1], which is not the case on Linux. Here are the rules:
Which options can be used together?
X: mutually exclusive
O: often used together
C: can be used together in some cases
P: could be used together but we prefer not to (optimisations)
| Opt: | MPC | MPJ | DSS | ADD | RM | PRIO | FAIL | FC |
|------|------|------|------|------|------|------|------|------|
| MPC |------|------|------|------|------|------|------|------|
| MPJ | X |------|------|------|------|------|------|------|
| DSS | X | X |------|------|------|------|------|------|
| ADD | X | X | P |------|------|------|------|------|
| RM | C | C | C | P |------|------|------|------|
| PRIO | X | C | C | C | C |------|------|------|
| FAIL | X | X | C | X | X | X |------|------|
| FC | X | X | P | X | X | X | X |------|
| RST | X | X | X | X | X | X | O | O |
|------|------|------|------|------|------|------|------|------|
The only difference is with the 'P': another stack could send and
ADD_ADDR with other suboptions (DSS, RM_ADDR), and this should be
allowed.
A few points of attention:
- In theory, an MP_CAPABLE could be used with a RM_ADDR, but there is
no reason to add it with a SYN. Note that even with a 4th ACK, it
doesn't seem to be useful, except when IDs are known in advance via
another channel. Better not to break that.
- Now, combining both an MP_CAPABLE and an MP_JOIN will no longer
result to a reject of the two options, but only the second suboption
is ignored. That seems OK to do that for this unexpected error. At
least now all inconsistent combinations are handled the same way.
This could change later in next. This also means the explicit checks
for having both MPC + MPJ in subflow.c will now be unreachable.
That's fine, they will be removed in a follow-up patch.
- In case of conflicting combinations, the extra suboption(s) is/are
ignored: having such combinations either means the remote peer is
buggy, or is evil. The simplest action is then taken in this case:
stop processing the current suboption.
- In mp_opt->suboptions, there is also a bit reserved to the checksum,
which can be used in an MP_CAPABLE and a DSS. Each time a DSS option
can be used in parallel with another option, the checksum can be set,
so the verification is combined into a new OPTIONS_MPTCP_DSS macro.
- An MP_CAPABLE ACK can carry a Data-Level Length, and an optional
Checksum: they are the same as the ones found in a DSS, because a DSS
cannot be used in parallel to an MP_CAPABLE. Similarly, even if there
is room, a DSS cannot be used with an MP_JOIN.
Referencias (7)
- git.kernel.org/stable/c/0e2210af439755a2af352eea4178261dcf61742e
- git.kernel.org/stable/c/d1bce616636c1c42649966677973490a510055c4
- git.kernel.org/stable/c/dc1d8d3eb345c616fbe922a010fa391c72c54d52
- git.kernel.org/stable/c/099bfcbd0c16ae9b50aba2a1bea033e63f895da7
- git.kernel.org/stable/c/a04dcc784959e4702048785d87e0d029bd2fbdcb
- git.kernel.org/stable/c/6bab907292155513af397a12ccb488acbfc30d79
- git.kernel.org/stable/c/b6ee361524641f57b2e2363f7737f20e17f67827
Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.