CVE-2026-89554
Received Received - Intake

Linux Kernel MPTCP Local ID Corruption via SYN Cookie

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale byte of a previously freed request socket, which an off-path peer can influence by sending concurrent MP_JOIN SYNs. This corrupts the path manager's id-based subflow bookkeeping for the connection. Restore subflow_req->local_id from the cookie entry, as done for the other fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-12
AI Q&A
2026-09-12
EPSS Evaluated
N/A
NVD
CVE-2026-89554
EUVD
EUVD-2026-76465

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of the local_id field during MP_JOIN reconstruction in SYN cookies. When rebuilding a request socket for a MP_JOIN 4th-ACK, the local_id field is not restored from the saved cookie entry, leading to uninitialized memory being used. This can corrupt the path manager's id-based subflow bookkeeping for the connection.

Detection Guidance

This vulnerability is specific to the Linux kernel's MPTCP implementation and may not have direct network detection commands. Monitor kernel logs for MPTCP-related errors or crashes, particularly during MP_JOIN operations. Check for corrupted path manager id-based subflow bookkeeping in connection logs.

Impact Analysis

An off-path peer could exploit this to influence the local_id value by sending concurrent MP_JOIN SYNs. This could lead to incorrect subflow management, potentially causing connection issues or unexpected behavior in the affected system.

Mitigation Strategies

Update the Linux kernel to the latest patched version that resolves this issue. If immediate patching is not possible, disable MPTCP functionality temporarily by setting the sysctl parameter net.mptcp.enabled to 0 until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89554. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart