mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-89554
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-09-11 20:19:39 UTC
Updated2026-09-11 20:19:39 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale byte of a previously freed request socket, which an off-path peer can influence by sending concurrent MP_JOIN SYNs. This corrupts the path manager's id-based subflow bookkeeping for the connection. Restore subflow_req->local_id from the cookie entry, as done for the other fields.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 64f2c5dd49b956a542c8c02b8dad5d262a462bba git Not specified
CNA Linux Linux affected 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 51887ccd88791ddaa8755a7c614fda031ecf7982 git Not specified
CNA Linux Linux affected 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 bf19d166337c6488b39cb03eeeffb30a941d6326 git Not specified
CNA Linux Linux affected 9466a1ccebbe54ac57fb8a89c2b4b854826546a8 b878dfdd12d7a5b8722a78d35e313506140ca3d9 git Not specified
CNA Linux Linux affected 5.9 Not specified
CNA Linux Linux unaffected 5.9 semver Not specified
CNA Linux Linux unaffected 6.12.109 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.50 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.4 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3-rc1 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report