# CVE-2026-89554

## Summary

- **CVE ID:** CVE-2026-89554
- **Severity:** HIGH
- **CVSS Score:** 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
- **CWE:** N/A
- **Published:** Sep 11, 2026
- **Last Modified:** Sep 14, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction

mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
backup, join_id, token and msk from the saved cookie entry when rebuilding
the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
does not restore local_id, even though the SYN path saved it.
subflow_ulp_clone() then reads that uninitialized field and stores it as
the joined subflow's address-ID. Because the request-sock slab is
SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
byte of a previously freed request socket, which an off-path peer can
influence by sending concurrent MP_JOIN SYNs. This corrupts the path
manager's id-based subflow bookkeeping for the connection.

Restore subflow_req->local_id from the cookie entry, as done for the other
fields.

## Affected Products

- Linux — Linux (9466a1ccebbe54ac57fb8a89c2b4b854826546a8)
- Linux — Linux (5.9)
- Linux — Linux (0)
- Linux — Linux (6.12.109)
- Linux — Linux (6.18.50)
- Linux — Linux (7.2.4)
- Linux — Linux (7.3-rc1)
- Linux — Linux (5.10.270)
- Linux — Linux (5.15.221)
- Linux — Linux (6.1.188)
- Linux — Linux (6.6.157)

## References

- [CNA](https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba)
- [CNA](https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982)
- [CNA](https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326)
- [CNA](https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9)
- [CNA](https://git.kernel.org/stable/c/4534e0eead692bb069ad1e6a5a245fc2e2078300)
- [CNA](https://git.kernel.org/stable/c/63cacb05e51a1c6e1349d2e593d00fd6ef43def4)
- [CNA](https://git.kernel.org/stable/c/954b5ea836eb118d188975ced803448537ab8479)
- [CNA](https://git.kernel.org/stable/c/9df36a4846375a9b75bf42d77bfed216b0f366f9)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.61%
- **EPSS Percentile:** 47.4

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-17._