CVE-2026-89554

A flaw was found in the Linux kernel's Multipath TCP MPTCP implementation. When reconstructing a Multipath TCP MPTCP join request under SYN cookies, the localid field is not properly initialized. An off-path attacker can influence this uninitialized field by sending concurrent MPJOIN SYN requests...