SB20260912222 - Use of Uninitialized Variable in Linux kernel mptcp

Description

This security bulletin contains information about 1 vulnerability.

1) Use of Uninitialized Variable (CVE-ID: CVE-2026-89554)

CWE-ID: CWE-457 - Use of Uninitialized Variable

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to corrupt the path manager's id-based subflow bookkeeping.

The vulnerability exists due to use of an uninitialized local_id field in mptcp_token_join_cookie_init_state() when reconstructing MP_JOIN request sockets for fourth acknowledgments under SYN cookies. A remote attacker can send concurrent MP_JOIN SYNs to influence the stale address ID and corrupt the path manager's id-based subflow bookkeeping.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/51887ccd88791ddaa8755a7c614fda031ecf7982
• https://git.kernel.org/stable/c/64f2c5dd49b956a542c8c02b8dad5d262a462bba
• https://git.kernel.org/stable/c/b878dfdd12d7a5b8722a78d35e313506140ca3d9
• https://git.kernel.org/stable/c/bf19d166337c6488b39cb03eeeffb30a941d6326