MPTCP uses TCP options fields, the vulnerability is in IP options.
replyThere are two types of multipath TCP and they are not at all the same.
replyWhat Apple does is, for example, being able to have a connection over WiFi and 5G simultaneously, with different IPs and routes.
The more traditional server side multipath is that you have a network card with 4 ports (eg 4x 25gbit) and connect them to a router, and make those 4 physical ports (paths) behave like a single interface. This helps either load balancing or redundancy.
The latter is what this vulnerability is about.
Sorry but that's plain wrong.
replyNeither has layer 2 LAG nor has layer 3 ECMP anything to-do with layer 4 MPTCP.
What's vulnerable is MPTCP.
That’s typically done with thinks like lacp, not multipath
reply