{"id":"CVE-2026-89554","title":"mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction\n\nmptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,\nbackup, join_id, token a…","severity":"high","cvss":8.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","cvssSource":"cna","cwe":["CWE-824"],"vendor":"Linux","product":"Linux","affected":["Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 4534e0eead692bb069ad1e6a5a245fc2e2078300","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 63cacb05e51a1c6e1349d2e593d00fd6ef43def4","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 954b5ea836eb118d188975ced803448537ab8479","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 9df36a4846375a9b75bf42d77bfed216b0f366f9","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 64f2c5dd49b956a542c8c02b8dad5d262a462bba","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 51887ccd88791ddaa8755a7c614fda031ecf7982","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < bf19d166337c6488b39cb03eeeffb30a941d6326","Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < b878dfdd12d7a5b8722a78d35e313506140ca3d9","Linux 5.9"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T19:23:57.686804Z"},"published":"2026-09-11","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:48:47.068Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89554","references":[{"url":"https://git.kernel.org/stable/c/4534e0eead692bb069ad1e6a5a245fc2e2078300"},{"url":"https://git.kernel.org/stable/c/63cacb05e51a1c6e1349d2e593d00fd6ef43def4"},{"url":"https://git.kernel.org/stable/c/954b5ea836eb118d188975ced803448537ab8479"},{"url":"https://git.kernel.org/stable/c/9df36a4846375a9b75bf42d77bfed216b0f366f9"},{"url":"https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba"},{"url":"https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982"},{"url":"https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326"},{"url":"https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89554.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89554"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532504"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89554"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89554"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89554.mbox"}],"tags":["cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00598,"epssPercentile":0.48432,"scores":{"cna":8.2,"vendor":5.5},"ingestedAt":"2026-09-14T15:23:07.451Z","slug":"CVE-2026-89554","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction\n\nmptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,\nbackup, join_id, token and msk from the saved cookie entry when rebuilding\nthe request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it\ndoes not restore local_id, even though the SYN path saved it.\nsubflow_ulp_clone() then reads that uninitialized field and stores it as\nthe joined subflow's address-ID. Because the request-sock slab is\nSLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale\nbyte of a previously freed request socket, which an off-path peer can\ninfluence by sending concurrent MP_JOIN SYNs. This corrupts the path\nmanager's id-based subflow bookkeeping for the connection.\n\nRestore subflow_req->local_id from the cookie entry, as done for the other\nfields.\n\n## Affected\n\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 4534e0eead692bb069ad1e6a5a245fc2e2078300`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 63cacb05e51a1c6e1349d2e593d00fd6ef43def4`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 954b5ea836eb118d188975ced803448537ab8479`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 9df36a4846375a9b75bf42d77bfed216b0f366f9`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 64f2c5dd49b956a542c8c02b8dad5d262a462bba`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < 51887ccd88791ddaa8755a7c614fda031ecf7982`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < bf19d166337c6488b39cb03eeeffb30a941d6326`\n- `Linux >= 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 < b878dfdd12d7a5b8722a78d35e313506140ca3d9`\n- `Linux 5.9`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89554.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":45.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":223283,"id":"CVE-2026-89554","ts":1792180042690,"field":"cvss","old":"5.5","new":"8.2"},{"seq":223282,"id":"CVE-2026-89554","ts":1792180042690,"field":"severity","old":"medium","new":"high"},{"seq":203947,"id":"CVE-2026-89554","ts":1789490230744,"field":"cvss","old":"8.2","new":"5.5"},{"seq":203946,"id":"CVE-2026-89554","ts":1789490230744,"field":"severity","old":"high","new":"medium"},{"seq":197928,"id":"CVE-2026-89554","ts":1789384320997,"field":"cvss","old":"6.5","new":"8.2"},{"seq":197927,"id":"CVE-2026-89554","ts":1789384320997,"field":"severity","old":"medium","new":"high"},{"seq":183479,"id":"CVE-2026-89554","ts":1789356675535,"field":"cvss","old":"8.2","new":"6.5"},{"seq":183478,"id":"CVE-2026-89554","ts":1789356675535,"field":"severity","old":"high","new":"medium"},{"seq":153362,"id":"CVE-2026-89554","ts":1789285350204,"field":"cvss","old":null,"new":"8.2"},{"seq":153361,"id":"CVE-2026-89554","ts":1789285350204,"field":"severity","old":"none","new":"high"},{"seq":147095,"id":"CVE-2026-89554","ts":1789270195148,"field":"cvss","old":null,"new":"6.5"},{"seq":147094,"id":"CVE-2026-89554","ts":1789270195148,"field":"severity","old":"none","new":"medium"},{"seq":108854,"id":"CVE-2026-89554","ts":1789183729265,"field":"cvss","old":null,"new":"6.5"},{"seq":108853,"id":"CVE-2026-89554","ts":1789183729265,"field":"severity","old":"none","new":"medium"}]}