CVE-2025-68291 mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple CVEs Identified in mptcp Implementation Two new Common Vulnerabilities and Exposures (CVEs) related to the mptcp implementation have been published. CVE-2025-68291, published on December 16, 2025, addresses an issue with initializing rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose(). CVE-2025-71088, published on January 13, 2026, involves fallback behavior on simultaneous connections. 2 sources 41