CVE-2026-89554

In the Linux kernel, the following vulnerability has been resolved:

mptcp: fix uninitialized local id in syncookie MP JOIN reconstruction

mptcp token join cookie init state() restores remote nonce, local nonce, backup, join id, token and msk from the saved cookie entry when rebuilding the request socket for a MP JOIN 4th-ACK handled under SYN cookies, but it does not restore local id, even though the SYN path saved it. subflow ulp clone() then reads that uninitialized field and stores it as the joined subflow's address-ID. Because the request-sock slab is SLAB TYPESAFE BY RCU and not zeroed on allocation, the value is the stale byte of a previously freed request socket, which an off-path peer can influence by sending concurrent MP JOIN SYNs. This corrupts the path manager's id-based subflow bookkeeping for the connection.

Restore subflow req->local id from the cookie entry, as done for the other fields.