8.2

CVE-2026-89554: linux

CVSS: 8.2v3.1HighReceived
AliasesUBUNTU-CVE-2026-89554DEBIAN-CVE-2026-89554
Published 11-09-2026Last modified 19-10-2026
Open JSON

Vulnerability summary

CVE-2026-89554 is a high (CVSS 8.2) vulnerability in linux. EPSS estimates a 0.60% chance of exploitation in the next 30 days, higher than 47.9% of scored vulnerabilities.

Overall risk
33/100
0100
Medium · default modelHow is this calculated?
CVSS score
8.2/10
010
High · v3.1 (CVE.org)
EPSS score
0.60%
0%100%
Low · -0.01 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
MGASA-2026-0506OPENSUSE-SU-2026:11880-1

Timeline

  1. 11-09-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale byte of a previously freed request socket, which an off-path peer can influence by sending concurrent MP_JOIN SYNs. This corrupts the path manager's id-based subflow bookkeeping for the connection. Restore subflow_req->local_id from the cookie entry, as done for the other fields.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.60%

Chance of exploitation in the next 30 days

Percentile

48%

Versus all other CVEs

30-day change

-0.01 pp

From 0.61% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.60%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Ubuntu157 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.111-1 | < 7.2.6-1
  • linux-6.12< 6.12.111-1~deb12u1
Linux1 product
  • linux≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < 4534e0eead692bb069ad1e6a5a245fc2e2078300 | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < 63cacb05e51a1c6e1349d2e593d00fd6ef43def4 | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < 954b5ea836eb118d188975ced803448537ab8479 | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < 9df36a4846375a9b75bf42d77bfed216b0f366f9 | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < 64f2c5dd49b956a542c8c02b8dad5d262a462bba | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < 51887ccd88791ddaa8755a7c614fda031ecf7982 | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < bf19d166337c6488b39cb03eeeffb30a941d6326 | ≥ 9466a1ccebbe54ac57fb8a89c2b4b854826546a8, < b878dfdd12d7a5b8722a78d35e313506140ca3d9 | 5.9

3 vendors · 160 products

References

13 links
Show all 13 references