CVE-2026-89554: Linux Kernel MPTCP Privilege Escalation

CVE-2026-89554 Overview

CVE-2026-89554 is a Linux kernel vulnerability in the Multipath TCP (MPTCP) subsystem. The function mptcp_token_join_cookie_init_state() fails to restore the local_id field when rebuilding a request socket for an MP_JOIN 4th-ACK handled under SYN cookies. The subflow_ulp_clone() function then reads the uninitialized field and stores it as the joined subflow's address identifier. Because the request-sock slab uses SLAB_TYPESAFE_BY_RCU and is not zeroed on allocation, the field contains stale bytes from a previously freed request socket. An off-path attacker can influence this stale value by sending concurrent MP_JOIN SYNs, corrupting the path manager's subflow bookkeeping.

Critical Impact
A remote off-path attacker can corrupt MPTCP subflow bookkeeping and induce integrity and availability impact on connections without authentication or user interaction.

Affected Products

Linux kernel branches containing the MPTCP SYN cookie MP_JOIN reconstruction logic in mptcp_token_join_cookie_init_state()
Distributions shipping vulnerable kernel builds with MPTCP enabled (CONFIG_MPTCP=y)
Systems with SYN cookies enabled (net.ipv4.tcp_syncookies) serving MPTCP endpoints

Discovery Timeline

2026-09-11 - CVE-2026-89554 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89554

Vulnerability Analysis

The flaw resides in the MPTCP subflow join path exercised when SYN cookies handle the initial MP_JOIN SYN. On the 4th-ACK, the kernel reconstructs the request socket from a saved cookie entry. The reconstruction restores remote_nonce, local_nonce, backup, join_id, token, and msk, but omits the local_id field that the SYN path originally recorded. Downstream, subflow_ulp_clone() consumes this uninitialized field and installs it as the joined subflow's address identifier, corrupting the connection's per-address subflow accounting.

This is a classic uninitialized memory use pattern [CWE-908] amplified by slab reuse semantics. Because request sockets are allocated from a SLAB_TYPESAFE_BY_RCU cache without zeroing, freed objects retain their previous contents. The uninitialized byte therefore reflects prior request-sock state, which an attacker can steer by controlling the allocation churn of adjacent MP_JOIN SYNs.

Root Cause

The root cause is an incomplete field restoration in mptcp_token_join_cookie_init_state(). The function must copy every attacker-observable field from the cookie entry back into the reconstructed subflow_req. Missing the local_id restore leaves that field holding stale slab memory, which is then read as if it were valid protocol state.

Attack Vector

An off-path remote attacker sends concurrent MP_JOIN SYN packets to influence the slab contents adjacent to the target reconstruction. When the legitimate 4th-ACK is processed under SYN cookies, the reconstructed subflow inherits an attacker-influenced local_id. This corrupts the path manager's id-keyed subflow bookkeeping for the target connection, degrading connection integrity and potentially producing subflow accounting inconsistencies that impact availability. No authentication or user interaction is required.

Verified patch commits are available from the upstream stable tree, including Kernel Commit 4534e0e, Kernel Commit 51887cc, and Kernel Commit bf19d16.

Detection Methods for CVE-2026-89554

Indicators of Compromise

Bursts of MP_JOIN SYN packets arriving from unrelated source addresses during high SYN-cookie load on MPTCP listeners.
MPTCP path manager warnings or accounting inconsistencies involving unexpected local_id values recorded against established subflows.
Unexplained subflow teardown or duplication events on multipath-enabled services under SYN flood conditions.

Detection Strategies

Inventory kernels running MPTCP-enabled workloads and compare build versions to the fixed upstream commits referenced in the advisory.
Instrument MPTCP tracepoints (for example mptcp:subflow_established) and alert on subflows whose local_id diverges from advertised addresses.
Correlate SYN cookie activation events with concurrent MP_JOIN SYN volume to surface likely exploitation conditions.

Monitoring Recommendations

Ship kernel audit logs and MPTCP counters into a centralized analytics pipeline for longitudinal review.
Baseline normal MP_JOIN volumes per listener and alert on statistical anomalies indicative of an off-path grooming attempt.
Track kernel package versions across the fleet to confirm patch rollout completion.

How to Mitigate CVE-2026-89554

Immediate Actions Required

Apply the vendor kernel update that includes the fix restoring subflow_req->local_id from the cookie entry.
On unpatched hosts that do not require MPTCP, disable the subsystem to remove the attack surface entirely.
Prioritize patching internet-facing services that terminate MPTCP connections and rely on SYN cookies during load.

Patch Information

The upstream fix restores subflow_req->local_id from the saved cookie entry alongside the other reconstructed fields. Patch sets are distributed across multiple stable branches. Reference the fix commits at Kernel Commit 63cacb0, Kernel Commit 64f2c5d, Kernel Commit 954b5ea, Kernel Commit 9df36a4, and Kernel Commit b878dfd. Rebuild and reboot affected hosts after installing the update.

Workarounds

Disable MPTCP if the workload does not require it by setting net.mptcp.enabled=0 via sysctl.
Reduce reliance on SYN cookies for MPTCP listeners by tuning net.ipv4.tcp_max_syn_backlog upward to absorb legitimate bursts without triggering cookie mode.
Restrict inbound MP_JOIN traffic to known peers using network-layer filtering where feasible.

bash

# Configuration example: disable MPTCP as a temporary workaround
sudo sysctl -w net.mptcp.enabled=0
echo 'net.mptcp.enabled=0' | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
sudo sysctl --system