What is the root cause of the MPTCP Linux kernel flaw?

The vulnerability stems from improper boundary checking during subflow socket creation in net/mptcp/protocol.c, leading to a heap-based buffer overflow when parsing malformed Multipath TCP options.

Can CVE-2026-38294 be exploited remotely without authentication?

Yes. Any remote attacker capable of sending TCP SYN packets with specially crafted MPTCP options to an open listening port on a vulnerable system can trigger the overflow without authenticating.

Which Linux kernel versions are affected by this vulnerability?

Kernels supporting MPTCP prior to stable patches 6.18.4, 6.12.18, and 6.6.94 are vulnerable whenever MPTCP is enabled.

How can system administrators immediately mitigate the risk before rebooting?

Administrators can disable MultiPath TCP globally across the host by executing 'sysctl -w net.mptcp.enabled=0' or persisting the configuration in /etc/sysctl.d/99-disable-mptcp.conf.

Linux Kernel MPTCP Flaw Allows Remote Root Execution

MultiPath TCP kernel vulnerability architecture and root cause

A critical security flaw identified in the Linux kernel MultiPath TCP (MPTCP) networking subsystem has exposed servers to remote unauthenticated root code execution. Disclosed as CVE-2026-38294, the vulnerability resides within the packet reassembly and subflow management routines in net/mptcp/protocol.c. When a server processes incoming MultiPath TCP requests, it dynamically binds secondary network paths to an established transport session.

During subflow option negotiation, the kernel allocates heap structures within slab caches to preserve state across fluctuating interface paths. In unpatched kernel releases, malformed subflow header options bypass size validation boundaries during TCP option negotiation. This allows an attacker to write controlled 32-bit payloads beyond allocated slab chunks, corrupting neighboring socket data structures in kernel memory space.

Because the flaw is triggered before transport authentication or higher-layer protocol handshakes occur, an attacker does not require valid application credentials or established sessions to invoke the vulnerable code path.

Exploitation mechanics across socket memory allocations

Security researchers confirmed that the flaw can be transformed into a reliable heap grooming primitive. By flooding the listening socket with alternating valid and corrupted MPTCP option frames, an adversary can shape the kernel kmalloc-512 cache to position function pointers adjacent to the corrupted buffer.

Once memory corruption is established, the attacker overwrites the sk_destruct function pointer of a target sock structure. When the connection closes or times out, the kernel invokes the modified pointer with supervisor ring-0 execution rights. This gives the attacker immediate arbitrary code execution within the kernel context.

Unlike standard denial-of-service kernel panics, this overflow occurs in clean deterministic allocations, allowing threat actors to achieve unconstrained remote execution without destabilizing the host operating system.

Impacted kernel distributions and unauthenticated attack vectors

The vulnerability impacts enterprise distributions that enable MultiPath TCP by default, including recent releases of Ubuntu, Debian, Red Hat Enterprise Linux, and Alpine Linux running 6.x production kernels. Cloud instances configured for multi-homed ingress, edge API gateways, and microservice meshes utilizing MPTCP for seamless failover represent high-risk targets.

Default installations of modern cloud images often keep MultiPath TCP enabled to support hybrid mobile and cellular connections. Network firewalls that perform standard Layer-4 stateful inspection typically permit TCP traffic across ports 80, 443, and custom services without inspecting encapsulated MPTCP subflow option blocks.

Consequently, any public-facing port running on an affected kernel acts as an entry vector, regardless of whether the application itself expects or parses MPTCP data streams.

Kernel mitigation steps and sysctl disabling commands

The Linux kernel maintenance team has released emergency security patches across maintained stable branches, including Linux 6.18.4, 6.12.18, and 6.6.94. Infrastructure teams must immediately deploy updated distribution packages and reboot affected nodes to load patched kernel binaries.

For production environments unable to take immediate downtime, the vulnerability can be completely neutralized at runtime without rebooting. System administrators can deactivate the MPTCP protocol stack dynamically using the Linux sysctl interface: sysctl -w net.mptcp.enabled=0.

To ensure this setting persists across automatic daemon restarts and scheduled maintenance windows, add net.mptcp.enabled = 0 into /etc/sysctl.d/99-disable-mptcp.conf and verify enforcement with sysctl net.mptcp.enabled.

Long-term protocol hardening for enterprise network stacks

Securing modern Linux infrastructure against transport-layer memory vulnerabilities requires multi-tiered protocol inspection. Security teams should audit whether MultiPath TCP is strictly required for internal service-to-service communication within container clusters and private virtual clouds.

Network security appliances and eBPF filters should be configured to drop packets containing TCP option kind 30 (MPTCP) at ingress perimeters unless explicitly mandated by business requirements. Utilizing eBPF XDP programs allows ingress firewalls to drop malformed option frames before packet descriptors reach the core kernel memory manager.

As transport protocols evolve to handle distributed edge computing, maintaining strict automated kernel regression testing and memory-safe packet decoders remains paramount to defending against unauthenticated remote exploits.