CVE-2026-89554

A flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. When reconstructing a Multipath TCP (MPTCP) join request under SYN cookies, the local_id field is not properly initialized. An off-path attacker can influence this uninitialized field by sending concurrent MP_JOIN SYN requests, leading to corruption of the path manager's subflow bookkeeping. This can result in a denial of service for affected MPTCP connections.

A MODERATE severity denial-of-service flaw was found in the Linux kernel's Multipath TCP (MPTCP) implementation. When SYN cookies are in use, mptcp_token_join_cookie_init_state() rebuilds the request socket for an MP_JOIN 4th-ACK from the saved cookie entry but does not restore the local_id field, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and is not zeroed on allocation, the value is a stale byte from a previously freed request socket, which an off-path peer can influence by sending concurrent MP_JOIN SYN requests. This corrupts the path manager's id-based subflow bookkeeping and can result in a denial of service for the affected MPTCP connections. Red Hat Enterprise Linux 8, 9, and 10 kernel streams and OpenShift Container Platform RHCOS builds that carry the vulnerable code are listed as affected, while Red Hat Enterprise Linux 6 and 7 ELS are not affected because the vulnerable code is not present in those kernels. The fix is currently deferred for the affected products: the impact is MODERATE and the Red Hat CVSS 3.1 score of 5.5 is below the 7.0 threshold at which trackers are filed for this severity, so no update is currently scheduled. The residual risk is limited to systems using MPTCP while SYN cookies are active, where an off-path attacker could disrupt MPTCP connections; confidentiality is not affected and the corruption is confined to internal MPTCP subflow bookkeeping. This differs from the upstream severity: the CVE.org record rates the flaw IMPORTANT with CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), while Red Hat rates it MODERATE with CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H); the two vectors differ in attack vector, privileges required, and integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.