A critical vulnerability in the Linux kernel MPTCP subsystem exposes systems to potential remote code execution or memory corruption via malformed network packets.

This vulnerability is an input validation error within the MPTCP options handling code. A remote, unauthenticated attacker can send a specially crafted DSS (Data Sequence Signal) option that forces the kernel to ignore the suboption while leaving residual data in memory, potentially resulting in unauthorized memory access.

The CVSS score of 9.8 indicates a critical severity, reflecting the ability for an unauthenticated remote attacker to compromise system integrity, confidentiality, and availability. Successful exploitation could lead to system crashes, denial of service, or arbitrary code execution, posing a significant risk to the stability and security of any infrastructure running affected Linux kernel versions.

Immediate Action: Apply the latest kernel security updates provided by your distribution vendor, specifically ensuring the kernel is upgraded to at least version 5.10.266, 5.15.217, 6.1.184, or 6.6.153.

Proactive Monitoring: Monitor system logs for kernel panics, segmentation faults, or unusual network traffic patterns associated with MPTCP protocol violations.

Compensating Controls: If patching is not immediately feasible, consider disabling the MPTCP protocol if it is not required for network operations to reduce the attack surface.

Public Exploit Available: Unknown

Given the critical nature of this kernel-level vulnerability and the potential for unauthenticated remote exploitation, organizations must prioritize patching as the primary defense. Administrators should coordinate an emergency update cycle to deploy the patched kernel versions across all affected production environments immediately to mitigate the risk of system compromise.