CVE-2026-89554 Linux CVE debrief

Who should care

Linux kernel maintainers, administrators of systems using MPTCP, security teams responsible for monitoring and patching Linux systems, and operators managing MPTCP connections should be aware of this vulnerability. They should verify MPTCP connection integrity, assess system exposure, and monitor for unusual activity. Maintainers and administrators need to apply patches and ensure system updates are in place. Security teams should review system logs and M

Why it matters

CVE-2026-89554 is a vulnerability in the Linux kernel's MPTCP implementation that can allow an off-path attacker to corrupt the path manager's id-based subflow bookkeeping. Defenders should verify MPTCP connection integrity, assess system exposure, and monitor for unusual activity. Patches are available, but scope and impact require further verification.

• Verify MPTCP connection integrity
• Assess system exposure and update inventory
• Monitor for unusual MPTCP activity

Technical summary

The Linux kernel's MPTCP implementation has a vulnerability in the syncookie MP_JOIN reconstruction process. The local_id field is not properly restored, allowing an off-path attacker to influence the path manager's subflow bookkeeping. This issue arises from the improper restoration of the local_id field in the syncookie MP_JOIN reconstruction process, which can lead to potential disruptions in MPTCP connections. Patches are available in referenced commits that address the issue by properly restoring the local_id field.

Defensive priority

Medium

Recommended defensive actions

• Review and apply patches from Linux kernel maintainers as available
• Monitor MPTCP connections for unusual activity
• Verify system exposure and update inventory accordingly
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected systems and potential impact require further verification. The Linux kernel maintainers have addressed the issue with patches available in the referenced commits.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.