SANS details detection of Linux Multipath TCP vulnerability

An ISC diary entry by Johannes Ullrich, published and updated on 2 November 2026, reports a new vulnerability in Linux’s implementation of Multipath TCP (MPTCP) tied to RFC 8684 and CVE-2026-98432. The note stresses that the vulnerability concerns an oft-ignored TCP option introduced in 2020, rather than a flaw in the core TCP mechanism itself.

Ullrich frames the discussion around MPTCP rather than detailing the vulnerability’s technical exploit, focusing on how MPTCP operates and how the presence of the 0x1e (30) TCP option is used to manage multiple subflows within a single connection.

The article explains what MPTCP is and why it exists: it allows a single connection to be split across multiple IP addresses and interfaces, which can be useful when devices switch networks (for example, from Wi‑Fi to cellular) without breaking applications. It notes that the best-known implementation at present appears to be on Apple platforms (iOS/iPadOS), where MPTCP has been used for services such as Siri and Apple Music.

The piece details the MPTCP options (MP_CAPABLE, MP_JOIN, DSS, ADD_ADDR, REMOVE_ADDR) and how they enable subflow creation and data sequencing across multiple paths. For detection, Ullrich highlights that the primary indicator is TCP Option 30 and provides practical guidance for several tools: Wireshark/tshark, tcpdump, Suricata, Snort, and Zeek, including how to recognise MP_CAPABLE messages and their embedded keys.

The post attributes the information to the RFCs and to Apple’s usage patterns, and references CVE-2026-98432 alongside RFC 8694 (RFC8684). It presents the material as a technical overview and detection guide rather than a field update with exploitation details. SOURCE_UNAVAILABLE