CVE-2026-89554 Linux Kernel - Memory Corruption

Linux kernel contains a memory corruption vulnerability caused by uninitialized local_id in syncookie MP_JOIN reconstruction, letting off-path attackers corrupt subflow bookkeeping, exploit requires sending concurrent MP_JOIN SYNs.

CVSS base score 8.2 /10
High
CISA KEV
Not listed
Public exploit
None known
Authentication
Not required
EPSS
0.60% chance of exploitation in 30 days
View the NVD record ↗