Cloudanix VulnDB

CVE-2026-89554

High · 8.2

CVSS

8.2

EPSS

0.6%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A flaw in how Linux handles certain network connection handshakes can let an attacker corrupt internal connection tracking, potentially disrupting network services.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Uninitialized local_id field in subflow request socket during MP_JOIN syncookie reconstruction leads to stale data from prior freed request-sock slab entry being used as address-ID, corrupting MPTCP path manager bookkeeping.

Why it matters to the business

Kernel systems using MPTCP may experience connection state corruption and potential denial of service under concurrent join attempts; widespread exposure in Linux distributions increases operational risk for high-availability networking.

How an attack unfolds

An off-path attacker sends crafted concurrent MP_JOIN SYNs to influence slab contents, triggers SYN-cookie path on the target, then supplies a 4th ACK that causes reconstruction to pull the corrupted local_id value into the subflow state.

How to fix it

Apply the upstream patch restoring subflow_req->local_id from the cookie entry in mptcp_token_join_cookie_init_state(); rebuild and deploy updated kernel images; disable MPTCP if not required until patched.

How to confirm the fix worked

Confirm kernel source contains the local_id restoration line in mptcp_token_join_cookie_init_state(); run MPTCP syncookie join test cases and verify no uninitialized address-ID values appear in subflow state dumps.

Typical attack path

  1. Send multiple MP_JOIN SYN packets with varying tokens to populate request-sock slab
  2. Trigger SYN-cookie handling on the victim MPTCP listener
  3. Transmit final MP_JOIN ACK to force cookie-based reconstruction
  4. Observe or induce path-manager corruption leading to subflow misassociation

How to detect it

Review kernel logs for MPTCP subflow state anomalies or slab-related warnings around the time of connection establishment; inspect network traces for unexpected concurrent MP_JOIN SYN/ACK patterns.

What your security team should do

  • Prioritize kernel updates on all MPTCP-enabled systems within standard patch windows given stable low EPSS and absence from KEV
  • Audit MPTCP usage and consider disabling via sysctl if feature is unnecessary
  • Monitor kernel mailing lists for backports to LTS branches

The record

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale byte of a previously freed request socket, which an off-path peer can influence by sending concurrent MP_JOIN SYNs. This corrupts the path manager's id-based subflow bookkeeping for the connection. Restore subflow_req->local_id from the cookie entry, as done for the other fields.

Affected packages

Ecosystem Package Introduced Fixed