if (flags & MPTCP_CAP_CHECKSUM_REQD)
                        mp_opt->csum_reqd = 1;
 
+               if (flags & MPTCP_CAP_DENY_JOIN_ID0)
+                       mp_opt->deny_join_id0 = 1;
+
                mp_opt->mp_capable = 1;
                if (opsize >= TCPOLEN_MPTCP_MPC_SYNACK) {
                        mp_opt->sndr_key = get_unaligned_be64(ptr);
        mp_opt->mp_prio = 0;
        mp_opt->reset = 0;
        mp_opt->csum_reqd = READ_ONCE(msk->csum_enabled);
+       mp_opt->deny_join_id0 = 0;
 
        length = (th->doff * 4) - sizeof(struct tcphdr);
        ptr = (const unsigned char *)(th + 1);
                return false;
        }
 
+       if (mp_opt->deny_join_id0)
+               WRITE_ONCE(msk->pm.remote_deny_join_id0, true);
+
        if (unlikely(!READ_ONCE(msk->pm.server_side)))
                pr_warn_once("bogus mpc option on established client sk");
        mptcp_subflow_fully_established(subflow, mp_opt);
 
        WRITE_ONCE(msk->pm.addr_signal, 0);
        WRITE_ONCE(msk->pm.accept_addr, false);
        WRITE_ONCE(msk->pm.accept_subflow, false);
+       WRITE_ONCE(msk->pm.remote_deny_join_id0, false);
        msk->pm.status = 0;
 
        spin_lock_init(&msk->pm.lock);
 
 
        /* check if should create a new subflow */
        if (msk->pm.local_addr_used < local_addr_max &&
-           msk->pm.subflows < subflows_max) {
+           msk->pm.subflows < subflows_max &&
+           !READ_ONCE(msk->pm.remote_deny_join_id0)) {
                local = select_local_address(pernet, msk);
                if (local) {
                        struct mptcp_addr_info remote = { 0 };
 
                mp_prio : 1,
                echo : 1,
                csum_reqd : 1,
-               backup : 1;
+               backup : 1,
+               deny_join_id0 : 1;
        u32     token;
        u32     nonce;
        u64     thmac;
        bool            work_pending;
        bool            accept_addr;
        bool            accept_subflow;
+       bool            remote_deny_join_id0;
        u8              add_addr_signaled;
        u8              add_addr_accepted;
        u8              local_addr_used;
 
 
                if (mp_opt.csum_reqd)
                        WRITE_ONCE(mptcp_sk(parent)->csum_enabled, true);
+               if (mp_opt.deny_join_id0)
+                       WRITE_ONCE(mptcp_sk(parent)->pm.remote_deny_join_id0, true);
                subflow->mp_capable = 1;
                subflow->can_ack = 1;
                subflow->remote_key = mp_opt.sndr_key;