EUVD-2026-76465
GHSA-9vj3-qjq5-h6jg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
AC:H reflects compound prerequisites: MPTCP enabled, SYN cookies active, and a slab-spray timing race; C:N confirmed; A:H and I:L match subflow disruption scope.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
mptcp: fix uninitialized local_id in syncookie MP_JOIN reconstruction
mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce, backup, join_id, token and msk from the saved cookie entry when rebuilding the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it does not restore local_id, even though the SYN path saved it. subflow_ulp_clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale byte of a previously freed request socket, which an off-path peer can influence by sending concurrent MP_JOIN SYNs. This corrupts the path manager's id-based subflow bookkeeping for the connection.
Restore subflow_req->local_id from the cookie entry, as done for the other fields.
AnalysisAI
Uninitialized memory use in the Linux kernel MPTCP subsystem allows a remote off-path peer to corrupt MPTCP subflow path manager bookkeeping by influencing a stale slab byte. Since Linux 5.9, mptcp_token_join_cookie_init_state() restores six fields from the SYN cookie entry during MP_JOIN 4th-ACK processing but omits local_id; subflow_ulp_clone() then reads whatever byte the SLAB_TYPESAFE_BY_RCU allocator left behind - a value an off-path attacker can steer by racing concurrent MP_JOIN SYNs against the slab recycler. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | MPTCP must be enabled on the server kernel (CONFIG_MPTCP=y compiled in and net.mptcp.enabled=1 active; enabled by default on recent Ubuntu, Fedora, and RHEL kernels but not universally so). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 8.2 with AV:N/AC:L/PR:N is overstated. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patches are available across all active stable series. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit your infrastructure to identify Linux systems running kernel versions 5.9 or later and determine which have MPTCP enabled (check kernel configuration, network bonding status, and multipath TCP connections). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today