{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-89554", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-89554" ], "published": "2026-09-11T19:47:07Z", "summary": "mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nmptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction\n\nmptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,\nbackup, join_id, token and msk from the saved cookie entry when rebuilding\nthe request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it\ndoes not restore local_id, even though the SYN path saved it.\nsubflow_ulp_clone() then reads that uninitialized field and stores it as\nthe joined subflow's address-ID. Because the request-sock slab is\nSLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale\nbyte of a previously freed request socket, which an off-path peer can\ninfluence by sending concurrent MP_JOIN SYNs. This corrupts the path\nmanager's id-based subflow bookkeeping for the connection.\n\nRestore subflow_req->local_id from the cookie entry, as done for the other\nfields.", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt2", "1:6.1.47-1+rpt4", "1:6.1.54-1+rpt2", "1:6.1.58-1+rpt2", "1:6.1.63-1+rpt1", "1:6.1.73-1+rpt1", "1:6.6.20-1+rpt1", "1:6.6.28-1+rpt1", "1:6.6.31-1+rpt1", "1:6.6.47-1+rpt1", "1:6.6.51-1+rpt1", "1:6.6.51-1+rpt2", "1:6.6.51-1+rpt3", "1:6.6.62-1+rpt1", "1:6.6.74-1+rpt1", "1:6.12.20-1+rpt1~bpo12+1", "1:6.12.25-1+rpt1", "1:6.12.34-1+rpt1~bookworm", "1:6.12.47-1+rpt1~bookworm", "1:6.12.62-1+rpt1~bookworm", "1:6.12.75-1+rpt1~bookworm", "1:6.12.87-1+rpt1~bookworm", "1:6.12.93-1+rpt1", "1:6.12.96-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi2-rpi-v8", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-2712", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi4-rpi-v8", "binary_version": "1:6.1.54-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi6-rpi-2712", "binary_version": "1:6.1.58-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi6-rpi-v8", "binary_version": "1:6.1.58-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi7-rpi-2712", "binary_version": "1:6.1.63-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi7-rpi-v8", "binary_version": "1:6.1.63-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi8-rpi-2712", "binary_version": "1:6.1.73-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi8-rpi-v8", "binary_version": "1:6.1.73-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-2712", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.20+rpt-rpi-v8", "binary_version": "1:6.6.20-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-2712", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.28+rpt-rpi-v8", "binary_version": "1:6.6.28-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-2712", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.31+rpt-rpi-v8", "binary_version": "1:6.6.31-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-2712", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.47+rpt-rpi-v8", "binary_version": "1:6.6.47-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt1" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt2" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-2712", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.51+rpt-rpi-v8", "binary_version": "1:6.6.51-1+rpt3" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-2712", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.62+rpt-rpi-v8", "binary_version": "1:6.6.62-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-2712", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.6.74+rpt-rpi-v8", "binary_version": "1:6.6.74-1+rpt1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-2712", "binary_version": "1:6.12.20-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-v8", "binary_version": "1:6.12.20-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-2712", "binary_version": "1:6.12.25-1+rpt1" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-v8", "binary_version": "1:6.12.25-1+rpt1" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-2712", "binary_version": "1:6.12.34-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8", "binary_version": "1:6.12.34-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt", "binary_version": "1:6.12.34-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-2712", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt", "binary_version": "1:6.12.47-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-2712", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt", "binary_version": "1:6.12.62-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-2712", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.87+rpt-rpi-v8-rt", "binary_version": "1:6.12.87-1+rpt1~bookworm" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-2712", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.93+rpt-rpi-v8-rt", "binary_version": "1:6.12.93-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-2712", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8", "binary_version": "1:6.12.96-1+rpt1" }, { "binary_name": "linux-image-6.12.96+rpt-rpi-v8-rt", "binary_version": "1:6.12.96-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt2": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.188" }, "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.188", "compiled_filter": false }, "1:6.1.54-1+rpt2": { "linux_commit": "2906f7abdc03d4a92b6b0e2e0c87ea2a9dffe8f7", "upstream_version": "6.1.54", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.188" }, "1:6.1.58-1+rpt2": { "linux_commit": "ccf1586ad0663fa91238ac56abf6340d6d740d18", "upstream_version": "6.1.58", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.188" }, "1:6.1.63-1+rpt1": { "linux_commit": null, "upstream_version": "6.1.63", "assessment": "upstream version (no usable Linux commit)", "upstream_fixed": "6.1.188" }, "1:6.1.73-1+rpt1": { "linux_commit": null, "upstream_version": "6.1.73", "assessment": "upstream version (no usable Linux commit)", "upstream_fixed": "6.1.188" }, "1:6.6.20-1+rpt1": { "linux_commit": "6f16847710cc0502450788b9f12f0a14d3429668", "upstream_version": "6.6.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.28-1+rpt1": { "linux_commit": "0c341f47adc3578cd5f817aa20ee2b7f9ae6b23e", "upstream_version": "6.6.28", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.31-1+rpt1": { "linux_commit": "c1432b4bae5b6582f4d32ba381459f33c34d1424", "upstream_version": "6.6.31", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.47-1+rpt1": { "linux_commit": "cf64a1dfecc2dc418efdd61701c1a4b185ab4761", "upstream_version": "6.6.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.51-1+rpt1": { "linux_commit": "0094eba3f2a4338cfa6854b0b5104d02ba0fa01f", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.51-1+rpt2": { "linux_commit": "82a50e430ef1d6eb37d78e25aa572c1f6ea56160", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.51-1+rpt3": { "linux_commit": "5aeecea9f4a45248bcf564dec924965e066a7bfd", "upstream_version": "6.6.51", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.62-1+rpt1": { "linux_commit": "dd2394360860d15146c96635796a75b05bb32b61", "upstream_version": "6.6.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.6.74-1+rpt1": { "linux_commit": "a18d9ced4965462cb7b3b4252ada440395105308", "upstream_version": "6.6.74", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.6.157" }, "1:6.12.20-1+rpt1~bpo12+1": { "linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa", "upstream_version": "6.12.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.25-1+rpt1": { "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16", "upstream_version": "6.12.25", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.34-1+rpt1~bookworm": { "linux_commit": "8f77e03530f65209a377d25023e912b288e039cd", "upstream_version": "6.12.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.47-1+rpt1~bookworm": { "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f", "upstream_version": "6.12.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.62-1+rpt1~bookworm": { "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c", "upstream_version": "6.12.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.75-1+rpt1~bookworm": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.87-1+rpt1~bookworm": { "linux_commit": "ae4d75fb36deba0fe1a986d9bfae65755e082dd0", "upstream_version": "6.12.87", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.93-1+rpt1": { "linux_commit": "d8ab4e908235da7727f22dd36ad5af224671677d", "upstream_version": "6.12.93", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.96-1+rpt1": { "linux_commit": "ae161617d7a4552fa91d03626b8d9f3696d17481", "upstream_version": "6.12.96", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" } } } }, { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.12.19-1+rpt1~bpo12+1", "1:6.12.19-1+rpt1", "1:6.12.20-1+rpt1", "1:6.12.25-1+rpt1+trixie", "1:6.12.34-1+rpt1", "1:6.12.47-1+rpt1", "1:6.12.62-1+rpt1", "1:6.12.75-1+rpt1", "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.12.19+rpt-rpi-2712", "binary_version": "1:6.12.19-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.19+rpt-rpi-v8", "binary_version": "1:6.12.19-1+rpt1~bpo12+1" }, { "binary_name": "linux-image-6.12.19+rpt-rpi-2712", "binary_version": "1:6.12.19-1+rpt1" }, { "binary_name": "linux-image-6.12.19+rpt-rpi-v8", "binary_version": "1:6.12.19-1+rpt1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-2712", "binary_version": "1:6.12.20-1+rpt1" }, { "binary_name": "linux-image-6.12.20+rpt-rpi-v8", "binary_version": "1:6.12.20-1+rpt1" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-2712", "binary_version": "1:6.12.25-1+rpt1+trixie" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-v8", "binary_version": "1:6.12.25-1+rpt1+trixie" }, { "binary_name": "linux-image-6.12.25+rpt-rpi-v8-rt", "binary_version": "1:6.12.25-1+rpt1+trixie" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-2712", "binary_version": "1:6.12.34-1+rpt1" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8", "binary_version": "1:6.12.34-1+rpt1" }, { "binary_name": "linux-image-6.12.34+rpt-rpi-v8-rt", "binary_version": "1:6.12.34-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-2712", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.47+rpt-rpi-v8-rt", "binary_version": "1:6.12.47-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-2712", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.62+rpt-rpi-v8-rt", "binary_version": "1:6.12.62-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-2712", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.12.75+rpt-rpi-v8-rt", "binary_version": "1:6.12.75-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.12.19-1+rpt1~bpo12+1": { "linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0", "upstream_version": "6.12.19", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.19-1+rpt1": { "linux_commit": "121c2c384b9c2f4790ffb31b2cd25c7d75c8fda0", "upstream_version": "6.12.19", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.20-1+rpt1": { "linux_commit": "cd231d4775b14f228606c09f219b48308f6ab3aa", "upstream_version": "6.12.20", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.25-1+rpt1+trixie": { "linux_commit": "3dd2c2c507c271d411fab2e82a2b3b7e0b6d3f16", "upstream_version": "6.12.25", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.34-1+rpt1": { "linux_commit": "8f77e03530f65209a377d25023e912b288e039cd", "upstream_version": "6.12.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.47-1+rpt1": { "linux_commit": "359f37f0faefb712add32a39f98751aea67d5c1f", "upstream_version": "6.12.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.62-1+rpt1": { "linux_commit": "a1073743767f9e7fdc7017ababd2a07ea0c97c1c", "upstream_version": "6.12.62", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.12.75-1+rpt1": { "linux_commit": "89050b1059997d38d55462b323b099a6436dc10d", "upstream_version": "6.12.75", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.12.109" }, "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.50" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89554" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/4534e0eead692bb069ad1e6a5a245fc2e2078300" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/63cacb05e51a1c6e1349d2e593d00fd6ef43def4" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/954b5ea836eb118d188975ced803448537ab8479" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9df36a4846375a9b75bf42d77bfed216b0f366f9" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-14T12:06:03Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 8.2, "cvss_v3_severity": "High", "scenario": "AV:N - The flaw is on the MPTCP MP_JOIN SYN-cookie receive path (tcp_v4_rcv/cookie_v4_check/mptcp_subflow_init_cookie_req/mptcp_token_join_cookie_init_state then subflow_ulp_clone). Any remote peer that can reach an MPTCP listener over routed IP triggers it with MP_JOIN packets when SYN cookies are in use.\nAC:L - An attacker can fill the SYN queue to force cookies (tcp_syncookies defaults to 1), spray concurrent MP_JOIN SYNs to seed the SLAB_TYPESAFE_BY_RCU request-sock cache with chosen local_id values, then complete a cookie MP_JOIN ACK. The attacker drives both the flood and the handshake; success does not depend on uninfluencable victim state.\nPR:N - No local account or capability is required. Any unauthenticated remote client obtains a token by completing MP_CAPABLE to a public MPTCP listener, then drives cookie JOIN; HMAC-valid JOIN from that peer, or slab poisoning of another connection's JOIN, needs no victim credentials.\nUI:N - Cookie MP_JOIN reconstruction runs in TCP receive softirq on attacker-sent segments; no local user mount, click, or other action is required beyond ordinary network reachability of an MPTCP service.\nS:U - Impact is confined to the host kernel's MPTCP path-manager and connection state and does not cross a VM, IOMMU, container, or other security authority.\nC:N - The uninitialized field is a single u8 address-ID leftover from a same-type request-sock slab object. It is not an out-of-bounds or pointer leak and does not disclose kernel memory contents to the attacker.\nI:L - subflow_ulp_clone stores the stale local_id as the joined subflow's address-ID, corrupting path-manager id-based bookkeeping (endpoint availability, ADD_ADDR/REMOVE_ADDR matching, and ID-0 primary-path identity). The modification is limited to that protocol ID and is not an arbitrary kernel write or control-flow primitive.\nA:H - A poisoned local_id of 0 or a colliding endpoint ID makes later REMOVE_ADDR/RMSUBFLOW close the initial or other still-needed subflows via mptcp_close_ssk, and desynchronized PM state can reject further joins or tear down the MPTCP session. An attacker can repeat this against many connections on an internet-facing MPTCP service." } } }