A critical vulnerability in the Linux kernel MPTCP implementation allows unauthenticated remote attackers to trigger inconsistent suboption processing, potentially leading to full system compromise.

The vulnerability exists in the MPTCP subsystem where incoming suboptions are not correctly validated for mutual exclusivity. An unauthenticated remote attacker can send specially crafted MPTCP packets to trigger undefined behavior in the kernel, leading to potential remote code execution or system instability.

The severity of this flaw is rated as critical with a CVSS score of 9.8, indicating that the vulnerability is remotely exploitable without authentication or user interaction. Successful exploitation could result in a complete loss of confidentiality, integrity, and availability, effectively granting an attacker full control over the affected host, which poses a severe risk to infrastructure stability and data security.

Immediate Action: Update the Linux kernel to version 6.6.153, 6.12.105, 6.18.46, or later, as provided by your distribution vendor.

Proactive Monitoring: Monitor network traffic for anomalous MPTCP connection patterns and review system logs for kernel panics or unexpected MPTCP-related error messages.

Compensating Controls: If immediate patching is not feasible, consider disabling MPTCP support at the kernel level if the feature is not required by your network architecture.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS score and the nature of the vulnerability within the core networking stack, organizations should prioritize the deployment of kernel updates across all affected Linux infrastructure. Immediate patching is the only reliable way to mitigate the risk of remote exploitation, as the complexity of the MPTCP protocol makes manual filtering via network appliances difficult and potentially prone to bypass.