{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-89554", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-11T19:38:34.724Z", "datePublished": "2026-09-11T19:44:27.586Z", "dateUpdated": "2026-10-19T08:48:47.068Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:48:47.068Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction\n\nmptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,\nbackup, join_id, token and msk from the saved cookie entry when rebuilding\nthe request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it\ndoes not restore local_id, even though the SYN path saved it.\nsubflow_ulp_clone() then reads that uninitialized field and stores it as\nthe joined subflow's address-ID. Because the request-sock slab is\nSLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale\nbyte of a previously freed request socket, which an off-path peer can\ninfluence by sending concurrent MP_JOIN SYNs. This corrupts the path\nmanager's id-based subflow bookkeeping for the connection.\n\nRestore subflow_req->local_id from the cookie entry, as done for the other\nfields."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "baseScore": 8.2, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is on the MPTCP MP_JOIN SYN-cookie receive path (tcp_v4_rcv/cookie_v4_check/mptcp_subflow_init_cookie_req/mptcp_token_join_cookie_init_state then subflow_ulp_clone). Any remote peer that can reach an MPTCP listener over routed IP triggers it with MP_JOIN packets when SYN cookies are in use.\nAC:L - An attacker can fill the SYN queue to force cookies (tcp_syncookies defaults to 1), spray concurrent MP_JOIN SYNs to seed the SLAB_TYPESAFE_BY_RCU request-sock cache with chosen local_id values, then complete a cookie MP_JOIN ACK. The attacker drives both the flood and the handshake; success does not depend on uninfluencable victim state.\nPR:N - No local account or capability is required. Any unauthenticated remote client obtains a token by completing MP_CAPABLE to a public MPTCP listener, then drives cookie JOIN; HMAC-valid JOIN from that peer, or slab poisoning of another connection's JOIN, needs no victim credentials.\nUI:N - Cookie MP_JOIN reconstruction runs in TCP receive softirq on attacker-sent segments; no local user mount, click, or other action is required beyond ordinary network reachability of an MPTCP service.\nS:U - Impact is confined to the host kernel's MPTCP path-manager and connection state and does not cross a VM, IOMMU, container, or other security authority.\nC:N - The uninitialized field is a single u8 address-ID leftover from a same-type request-sock slab object. It is not an out-of-bounds or pointer leak and does not disclose kernel memory contents to the attacker.\nI:L - subflow_ulp_clone stores the stale local_id as the joined subflow's address-ID, corrupting path-manager id-based bookkeeping (endpoint availability, ADD_ADDR/REMOVE_ADDR matching, and ID-0 primary-path identity). The modification is limited to that protocol ID and is not an arbitrary kernel write or control-flow primitive.\nA:H - A poisoned local_id of 0 or a colliding endpoint ID makes later REMOVE_ADDR/RMSUBFLOW close the initial or other still-needed subflows via mptcp_close_ssk, and desynchronized PM state can reject further joins or tear down the MPTCP session. An attacker can repeat this against many connections on an internet-facing MPTCP service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/syncookies.c"], "versions": [{"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "4534e0eead692bb069ad1e6a5a245fc2e2078300", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "63cacb05e51a1c6e1349d2e593d00fd6ef43def4", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "954b5ea836eb118d188975ced803448537ab8479", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "9df36a4846375a9b75bf42d77bfed216b0f366f9", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "64f2c5dd49b956a542c8c02b8dad5d262a462bba", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "51887ccd88791ddaa8755a7c614fda031ecf7982", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "bf19d166337c6488b39cb03eeeffb30a941d6326", "status": "affected", "versionType": "git"}, {"version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "b878dfdd12d7a5b8722a78d35e313506140ca3d9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/mptcp/syncookies.c"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.270", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.221", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.188", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.157", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.109", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.50", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.4", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.10.270"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "5.15.221"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.1.188"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.6.157"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.12.109"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "6.18.50"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.2.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/4534e0eead692bb069ad1e6a5a245fc2e2078300"}, {"url": "https://git.kernel.org/stable/c/63cacb05e51a1c6e1349d2e593d00fd6ef43def4"}, {"url": "https://git.kernel.org/stable/c/954b5ea836eb118d188975ced803448537ab8479"}, {"url": "https://git.kernel.org/stable/c/9df36a4846375a9b75bf42d77bfed216b0f366f9"}, {"url": "https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba"}, {"url": "https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982"}, {"url": "https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326"}, {"url": "https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9"}], "title": "mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:23:57.686804Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:26:43.610Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-89554", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:23:57.686804Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:23:58.567Z"}}], "cna": {"title": "mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is on the MPTCP MP_JOIN SYN-cookie receive path (tcp_v4_rcv/cookie_v4_check/mptcp_subflow_init_cookie_req/mptcp_token_join_cookie_init_state then subflow_ulp_clone). Any remote peer that can reach an MPTCP listener over routed IP triggers it with MP_JOIN packets when SYN cookies are in use.\nAC:L - An attacker can fill the SYN queue to force cookies (tcp_syncookies defaults to 1), spray concurrent MP_JOIN SYNs to seed the SLAB_TYPESAFE_BY_RCU request-sock cache with chosen local_id values, then complete a cookie MP_JOIN ACK. The attacker drives both the flood and the handshake; success does not depend on uninfluencable victim state.\nPR:N - No local account or capability is required. Any unauthenticated remote client obtains a token by completing MP_CAPABLE to a public MPTCP listener, then drives cookie JOIN; HMAC-valid JOIN from that peer, or slab poisoning of another connection's JOIN, needs no victim credentials.\nUI:N - Cookie MP_JOIN reconstruction runs in TCP receive softirq on attacker-sent segments; no local user mount, click, or other action is required beyond ordinary network reachability of an MPTCP service.\nS:U - Impact is confined to the host kernel's MPTCP path-manager and connection state and does not cross a VM, IOMMU, container, or other security authority.\nC:N - The uninitialized field is a single u8 address-ID leftover from a same-type request-sock slab object. It is not an out-of-bounds or pointer leak and does not disclose kernel memory contents to the attacker.\nI:L - subflow_ulp_clone stores the stale local_id as the joined subflow's address-ID, corrupting path-manager id-based bookkeeping (endpoint availability, ADD_ADDR/REMOVE_ADDR matching, and ID-0 primary-path identity). The modification is limited to that protocol ID and is not an arbitrary kernel write or control-flow primitive.\nA:H - A poisoned local_id of 0 or a colliding endpoint ID makes later REMOVE_ADDR/RMSUBFLOW close the initial or other still-needed subflows via mptcp_close_ssk, and desynchronized PM state can reject further joins or tear down the MPTCP session. An attacker can repeat this against many connections on an internet-facing MPTCP service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "4534e0eead692bb069ad1e6a5a245fc2e2078300", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "63cacb05e51a1c6e1349d2e593d00fd6ef43def4", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "954b5ea836eb118d188975ced803448537ab8479", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "9df36a4846375a9b75bf42d77bfed216b0f366f9", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "64f2c5dd49b956a542c8c02b8dad5d262a462bba", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "51887ccd88791ddaa8755a7c614fda031ecf7982", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "bf19d166337c6488b39cb03eeeffb30a941d6326", "versionType": "git"}, {"status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "lessThan": "b878dfdd12d7a5b8722a78d35e313506140ca3d9", "versionType": "git"}], "programFiles": ["net/mptcp/syncookies.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"status": "unaffected", "version": "0", "lessThan": "5.9", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.270", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.221", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.188", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.157", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.109", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.50", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.2.4", "versionType": "semver", "lessThanOrEqual": "7.2.*"}, {"status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/mptcp/syncookies.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/4534e0eead692bb069ad1e6a5a245fc2e2078300"}, {"url": "https://git.kernel.org/stable/c/63cacb05e51a1c6e1349d2e593d00fd6ef43def4"}, {"url": "https://git.kernel.org/stable/c/954b5ea836eb118d188975ced803448537ab8479"}, {"url": "https://git.kernel.org/stable/c/9df36a4846375a9b75bf42d77bfed216b0f366f9"}, {"url": "https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba"}, {"url": "https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982"}, {"url": "https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326"}, {"url": "https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction\n\nmptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,\nbackup, join_id, token and msk from the saved cookie entry when rebuilding\nthe request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it\ndoes not restore local_id, even though the SYN path saved it.\nsubflow_ulp_clone() then reads that uninitialized field and stores it as\nthe joined subflow's address-ID. Because the request-sock slab is\nSLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale\nbyte of a previously freed request socket, which an off-path peer can\ninfluence by sending concurrent MP_JOIN SYNs. This corrupts the path\nmanager's id-based subflow bookkeeping for the connection.\n\nRestore subflow_req->local_id from the cookie entry, as done for the other\nfields."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.270", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.221", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.188", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.157", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.109", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.50", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2.4", "versionStartIncluding": "5.9"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.3", "versionStartIncluding": "5.9"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T08:48:47.068Z"}}}, "cveMetadata": {"cveId": "CVE-2026-89554", "state": "PUBLISHED", "dateUpdated": "2026-10-19T08:48:47.068Z", "dateReserved": "2026-09-11T19:38:34.724Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-09-11T19:44:27.586Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/mptcp/syncookies.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "4534e0eead692bb069ad1e6a5a245fc2e2078300", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "63cacb05e51a1c6e1349d2e593d00fd6ef43def4", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "954b5ea836eb118d188975ced803448537ab8479", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "9df36a4846375a9b75bf42d77bfed216b0f366f9", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "64f2c5dd49b956a542c8c02b8dad5d262a462bba", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "51887ccd88791ddaa8755a7c614fda031ecf7982", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "bf19d166337c6488b39cb03eeeffb30a941d6326", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}, {"lessThan": "b878dfdd12d7a5b8722a78d35e313506140ca3d9", "status": "affected", "version": "9466a1ccebbe54ac57fb8a89c2b4b854826546a8", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/mptcp/syncookies.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.270", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.221", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.188", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.157", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.109", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.50", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.4", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction\n\nmptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,\nbackup, join_id, token and msk from the saved cookie entry when rebuilding\nthe request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it\ndoes not restore local_id, even though the SYN path saved it.\nsubflow_ulp_clone() then reads that uninitialized field and stores it as\nthe joined subflow's address-ID. Because the request-sock slab is\nSLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale\nbyte of a previously freed request socket, which an off-path peer can\ninfluence by sending concurrent MP_JOIN SYNs. This corrupts the path\nmanager's id-based subflow bookkeeping for the connection.\n\nRestore subflow_req->local_id from the cookie entry, as done for the other\nfields."}], "id": "CVE-2026-89554", "lastModified": "2026-10-19T09:17:50.783", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-89554", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:23:57.686804Z", "version": "2.0.3"}}]}, "published": "2026-09-11T20:19:39.020", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4534e0eead692bb069ad1e6a5a245fc2e2078300"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63cacb05e51a1c6e1349d2e593d00fd6ef43def4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/954b5ea836eb118d188975ced803448537ab8479"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9df36a4846375a9b75bf42d77bfed216b0f366f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: Linux kernel: MPTCP denial of service due to uninitialized local_id", "id": "2532504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2532504"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. When reconstructing a Multipath TCP (MPTCP) join request under SYN cookies, the `local_id` field is not properly initialized. An off-path attacker can influence this uninitialized field by sending concurrent MP_JOIN SYN requests, leading to corruption of the path manager's subflow bookkeeping. This can result in a denial of service for affected MPTCP connections."], "name": "CVE-2026-89554", "public_date": "2026-09-11T19:44:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-89554\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89554\nhttps://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982\nhttps://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba\nhttps://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9\nhttps://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326"], "threat_severity": "Moderate"}